Incident Report: DNS Outage due to DDoS Attack

devicenull wrote: post #3

Another reminder: If you're running DNS servers, make sure you are not providing recursion: http://openresolverproject.org/

Had dnsimple failed to do so? Did it help?

Because Easydns http://blog.easydns.org/2013/06/04/post-mortem-of-the-june-3... said "While most of these typically use open resolvers, it is also now common to use authoritative nameservers in reflection attacks".

Can we end the "War on 'Open' Internet (Resolvers)" now?

Because I don't think an organized crackdown on "open" authoritative nameservers is in the best interests of our freedom.

Re: Incident Report: DNS Outage due to DDoS Attack

#6

Post by darkarmani » Wed, Jun 05, 2013, 3:06 AM UTC

kmasters wrote: post #4

Dont care about DNS, its your problem, fix it and stop whining about hackers.

What do you use a massive /etc/hosts file?

Re: Incident Report: DNS Outage due to DDoS Attack

#7

Post by bigiain » Wed, Jun 05, 2013, 3:23 AM UTC

Is there something "going on" with DNS DDOS right now, or have I just happened to notice several in the last few days? cloudns.net, EasyDNS, and now dnsimple.com - all in the last week...

Re: Incident Report: DNS Outage due to DDoS Attack

#8

Post by 501 » Wed, Jun 05, 2013, 3:37 AM UTC

bigiain wrote: post #7

Is there something "going on" with DNS DDOS right now, or have I just happened to notice several in the last few days? cloudns.net, EasyDNS, and now dnsimple.com - all in the last week...

I don't think it's anything out of the ordinary. Attacks happen quite regularly, most are mitigated quickly and quietly.

Re: Incident Report: DNS Outage due to DDoS Attack

#9

Post by staunch » Wed, Jun 05, 2013, 4:39 AM UTC

darkarmani wrote: post #6

kmasters wrote: post #4

Dont care about DNS, its your problem, fix it and stop whining about hackers.

What do you use a massive /etc/hosts file?

I just use IPs and netcat. Accessing sites via SSL is a good mental workout.

Re: Incident Report: DNS Outage due to DDoS Attack

#10

Post by aeden » Wed, Jun 05, 2013, 5:10 AM UTC

marshray wrote: post #5

devicenull wrote: post #3

Another reminder: If you're running DNS servers, make sure you are not providing recursion: http://openresolverproject.org/

Had dnsimple failed to do so? Did it help? Because Easydns http://blog.easydns.org/2013/06/04/post-mortem-of-the-june-3... said "While most of these typically use open resolvers, it is also now common to use authoritative nameservers in reflection attacks". Can we end the "War on 'Open' Internet (Resolvers)" now? Because I don't think an organized crackdown on "open" authoritative nameservers is in the best interests…

No, this was not due to open resolvers in this case. We do not run public resolvers - we only provide authoritative DNS.