Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

681–690 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#681

Post by robryk »

mnordhoff wrote: post #675
robryk wrote: post #274

Earlier quoted context omitted.

If a server goes away for good, at some point NS records will stop pointing to it. We could serve stale records as long as all of the stale record's authority chain is either still there or unreachable.

I've had an IP address from a certain cloud provider for a month. Some abandoned domain still has its nameserver and glue records pointing to the IP, and i get DNS queries all the time. The domain expires in January. I hope it's not set to auto-renew. :-)

Note that this is already happening. The only thing my proposal would change is that it would also affect servers that used to be authoritative for subdomains of such abandoned domains. I would expect there to be very few of them: very few domains have delegations of subdomains to a different DNS server and they are larger and thus less likely to be abandoned.

Re: DDoS Attack Against Dyn Managed DNS

#682

Post by yannovitch »

prefect42 wrote: post #260
6d6b73 wrote: post #92

Earlier quoted context omitted.

If you have any substantial business, you already have a sysadmin on your team. He's not doing his job if he has no local versions of almost everything that is online. He should be staging everything locally, before deploying to the cloud. The currently very popular way of deploying everything live, without any testing, or staging is one of the reasons behind current crappy state of the internet.

I disagree, with very large companies, you have no "local" sysadmin, and no local versions of anything. Especially if your IT department is actually its own company.

Source/proof ?

Re: DDoS Attack Against Dyn Managed DNS

#683

Post by icebraining »

mej10 wrote: post #298
leesalminen wrote: post #288

Earlier quoted context omitted.

One possible issue is that IPs are re-used in cloud environments. Potentially, your browser could POST sensitive data to an IP address that now belongs to a totally different company.

Yeah, that is definitely possible. I mean, hopefully it is over HTTPS so they can't do anything with it... but if it isn't then it can definitely happen. Our servers get random web traffic all of the time.

I mean, hopefully it is over HTTPS so they can't do anything with it...

DV certs only rely on you being able to reply to an HTTP request, so if any CA was using such a caching DNS server, you could probably get a valid cert from them.

Re: DDoS Attack Against Dyn Managed DNS

#684

Post by mnordhoff »

Rapzid wrote: post #658
cddotdotslash wrote: post #579

Earlier quoted context omitted.

Right, this was my point. Hosting "status.domain.com" doesn't help much when it's "domain.com" that's having the problem. I think today's event will make a lot of companies consider this a bit more.

Hiiiinnnnndsiighhhttttt!!!!! Yeaaaahhhhyeahh! Anyway, for them to take the github.com nameservers out of the mix they would need a completely separate domain name; would you know to look there? You can delegate subdomains to other providers, but the NS records are still present in the servers listed in the registrar. So, you'd already need multiple DNS providers.. And you wouldn't have been down. Just sayin. I'm not…

I mean, some organizations do take precautions against this point of failure and use a separate status domain. Most don't.

https://www.dynstatus.com/ (using Route 53, at least today)

https://www.cloudflarestatus.com/ (using Dyn, ironically)

Re: DDoS Attack Against Dyn Managed DNS

#685

Post by icebraining »

leesalminen wrote: post #402
woot01 wrote: post #389

Earlier quoted context omitted.

HTTPS does not protect you against sending data to a host owned by another company.

Correct, but they wouldn't be able to decrypt the data.

The data doesn't even get there, the handshake kills the connection before that.

Re: DDoS Attack Against Dyn Managed DNS

#686

Post by yannovitch »

tobz wrote: post #99
6d6b73 wrote: post #61

Earlier quoted context omitted.

And I'm so damn tired of people complaining about cost to run stuff locally. The true cost of not having some basic stuff setup locally, even for backup purposes is when situation like this happens. It does not take long time or resources to download all of the libraries, with corresponding docs to a local server, or even your laptop. It is not complicated to have all of the new issues sent to an email to have a vers…

This is a DNS outage. If self-hosted, somewhere, you could still be screwed by having Dyn as your DNS provider. If dev-machine-hosted, then uh, your issue tracker is no longer an issue tracker. Your build server is not a build server. All the services besides Git are not meant to operate offline in a decentralized/distributed fashion. Library documentation, sure, that could be local. Otherwise, your assertion that al…

I'm under the impression that you say self-hosted ~= dev-machine-hosted ?

If that's the case, i think you're misguided : imho, the internet as it was designed was conceived so that everyone has its little self-hosted thing, with dev-machine just for the purpose of, well, test and dev, with the latter goal of it being self-hosted.

Just look how email is technically designed and how it was meant to work, and we use it now, relying mostly on Gmail or Outlook, or worse, using Facebook for emails : we put all our eggs in the same basket.

Re: DDoS Attack Against Dyn Managed DNS

#687

Post by yannovitch »

ravenstine wrote: post #539
6d6b73 wrote: post #61

Earlier quoted context omitted.

And I'm so damn tired of people complaining about cost to run stuff locally. The true cost of not having some basic stuff setup locally, even for backup purposes is when situation like this happens. It does not take long time or resources to download all of the libraries, with corresponding docs to a local server, or even your laptop. It is not complicated to have all of the new issues sent to an email to have a vers…

If I were running a business, here are the options as I'd see them: Option A) Spend no money and experience an outage maybe once a year, if that. And the problem works itself out. Option B) Spend money and gain technical debt to avoid a problem that happens maybe once a year, if that. Which one would you pick? I mean, maybe if everything you have is closed-source or you are guaranteeing 99.9% uptime to your customers…

What's your source that you "experience an outage maybe once a year" ??

I work in IT infrastructure and I see attacks literally every day, moreover, most people just setup a quick LAMP or MEAN stack to prove their concept, and then they leave it like that, so most of the time, no, the problem don't just "work itself out".

Re: DDoS Attack Against Dyn Managed DNS

#688

Post by faktorialas »

kettu228 wrote: post #436
AmrEldib wrote: post #371

Earlier quoted context omitted.

Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…

> - Finland (yes, Finland) is increasingly worried about Russia. They violated their air space, and they're questioning Finland's independence. Finland shares a long boarder with Russia. The Finns actually have still quite good relationship with Russia (better than other neighbors) and nobody's actually questioning Finland's independence. Baltic countries is a different story. Source: A Finn here.

Lithuanian here, can confirm. Quite scared of Russia, for (what I hope are) understandable reasons.

Re: DDoS Attack Against Dyn Managed DNS

#689

Post by scoot »

Xorlev wrote: post #645
duaneb wrote: post #638

Earlier quoted context omitted.

Yes, but beware, they (at least used to) resolve unknown names to a page filled with ads.

They stopped that. https://www.opendns.com/no-more-ads/

That's good to know - the ads are the reason I reluctantly switched from OpenDNS to google.

(Reluctantly in that Google already has enough of my data, thanks, through gmail, search, maps, docs and other services, not because it doesn't work well.)

Post reply on HN