Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive Dyn DNS outage

news.ycombinator.com

Post reply on HN
Print view View original

291–300 of 302 posts

Re: Massive Dyn DNS outage

#291

Post by indigomm »

atom_enger wrote: post #280
paulddraper wrote: post #191

I thought DNS (particularly public) was basically immune to DDoS? If one DNS server is down, use the cached result or another server. DNS is some of the most distributable, cachable data I can imagine.

The problem here lies with the authoritative nameservers. You have to retrieve the record from somewhere initially. The trouble here is that since these companies are using Dyn and only Dyn to be their Nameservers. When a dns request is made for github.com they're attempting to contact ns3.p20.dynect.net or another nameserver provided by Dyn. So yes caching will work for a little while, but only for the length of the…

It was true that one DNS nameserver record == one physical server even at large providers. But we're beyond that now. Each nameserver at a physical location can be a cluster of hosts. Beyond that, with the use of anycast that single nameserver record may map to different clusters positioned around the world. This is how the root servers work and why they are more difficult to attack.

Of course small DNS providers will find it hard to run a system this way, but the larger providers follow the same architecture - anycast and multiple servers at each location. Google and OpenDNS for a start use this pattern - the famous 8.8.8.8 and 8.8.4.4 are in fact multiple server clusters all around the world.

Re: Massive Dyn DNS outage

#292

Post by deno »

drmunklung wrote: post #181
deno wrote: post #64

Earlier quoted context omitted.

You’re right :) $ dig @8.8.8.8 ns +short pornhub.com ns2.p44.dynect.net. ns3.p44.dynect.net. ns4.p44.dynect.net. sdns3.ultradns.net. sdns3.ultradns.com. sdns3.ultradns.org. sdns3.ultradns.biz. ns1.p44.dynect.net. PornHub has better DNS redundancy than Github and Twitter.

I'm sure this is to circumvent blacklisting rather than for this scenario.

I can’t think of any type of blacklisting this would prevent. Care you elaborate?

Re: Massive Dyn DNS outage

#293

Post by nzp »

facorreia wrote: post #199
paulddraper wrote: post #191

I thought DNS (particularly public) was basically immune to DDoS? If one DNS server is down, use the cached result or another server. DNS is some of the most distributable, cachable data I can imagine.

> DNS is some of the most distributable, cachable data I can imagine. Indeed. How can it be so broken? And, it seem that it would make sense to use the last known value if upstream is unavailable.

That would be a horrible idea from a security standpoint. Although not easy by any means for an ordinary attacker, at least one exploit scenario is obvious.

Re: Massive Dyn DNS outage

#294

Post by waterhouse »

karmajunkie wrote: post #156
BlackGuyCoding wrote: post #136

Earlier quoted context omitted.

agreed 100%. This kind of thing shouldn't happen and this widespread. It's like no one is preparing for worse case scenarios until AFTER something tragic happens. On the West Coast and I just lost twitter/soundcloud/github - 9:40 am PST

loss of twitter, soundcloud, and github is what passes for tragic these days?

Let's say that it's tragic for the people whose job it is to maintain those services.

Re: Massive Dyn DNS outage

#295

Post by latentsurfer »

The DDOS also hit small business websites in North America. I know atleast three companies who experienced the DDOS attacks. The IPs that were port scanning prior to the attack are 173.254.216.66, 128.52.128.105 (MIT Edu), 172.98.67.39. I hope there is some action against these hackers.

Re: Massive Dyn DNS outage

#296

Post by atom_enger »

indigomm wrote: post #291
atom_enger wrote: post #280

Earlier quoted context omitted.

The problem here lies with the authoritative nameservers. You have to retrieve the record from somewhere initially. The trouble here is that since these companies are using Dyn and only Dyn to be their Nameservers. When a dns request is made for github.com they're attempting to contact ns3.p20.dynect.net or another nameserver provided by Dyn. So yes caching will work for a little while, but only for the length of the…

It was true that one DNS nameserver record == one physical server even at large providers. But we're beyond that now. Each nameserver at a physical location can be a cluster of hosts. Beyond that, with the use of anycast that single nameserver record may map to different clusters positioned around the world. This is how the root servers work and why they are more difficult to attack. Of course small DNS providers wil…

Sure - I assumed that's what the large organizations were doing but for the sake of explanation to those who didn't understand why the problem existed in the first place I didn't want to complicate my answer with something even more complex :) Appreciate your help doing so

Re: Massive Dyn DNS outage

#297

Post by Aoreias »

freshyill wrote: post #50

Five Thirty Eight! Today was a very long train ride without Twitter or the poll tracker.

They stayed up all day, they just blocked rendering until they loaded some twitter assets, causing it to take 20-30 seconds to load until those assets timed out.

Re: Massive Dyn DNS outage

#300

Post by 123456789101112 »

6d6b73 wrote: post #32

All this talk about redundancy, real-time apps, scalable architecture and and a "simple" DDOS against DNS architecture brings half of the internet down. Honestly did nobody think about having a spare dns at some other company? or even backup dns server exactly for a situation like that?

..and they thought war happens only with guns and tanks. don't the know, digital is the new platform to kill each other?
Post reply on HN