DDoS Attack Against Dyn Managed DNS • Hacker News Board

Re: DDoS Attack Against Dyn Managed DNS

#151

Post by TurningCanadian » Fri, Oct 21, 2016, 2:46 PM UTC

wongarsu wrote: post #109

dijit wrote: post #60

Earlier quoted context omitted.

that's not going to help much if the authoritative name servers (which is what dyn is, btw) go down for more than a day. Max record cache time is 86400s (24h), so if the attackers can keep it down for 24h then google will have to have custom instructions in place (or cache more aggressively than the RFC allows)

Since the attacked dyndns DNS servers are evidently anycast, the google server you are reaching might connect to a different dyndns server than you do. If google has luck to reach a less overloaded server, they might get an answer where you get none.

Side note:

In addition, Google Public DNS engineers have proposed a technical solution called EDNS Client Subnet. This proposal allows resolvers to pass in part of the client's IP address (the first 24/64 bits or less for IPv4/IPv6 respectively) as the source IP in the DNS message, so that name servers can return optimized results based on the user's location rather than that of the resolver. To date, we have deployed an implementation of the proposal for many large CDNs (including Akamai) and Google properties. The majority of geo-sensitive domain names are already covered.

from https://developers.google.com/speed/public-dns/faq

Re: DDoS Attack Against Dyn Managed DNS

#152

Post by marcoslater » Fri, Oct 21, 2016, 2:48 PM UTC

colanderman wrote: post #86

ljosa wrote: post #58

AWS says "We are investigating elevated errors resolving the DNS hostnames used to access some AWS services in the US-EAST-1 Region." Is that coincidental, or are they being DDoSed also?

Apparently us-east-1 is backed by Dyn (and only Dyn) as well? $ host -t NS us-east-1.amazonaws.com us-east-1.amazonaws.com name server ns3.p31.dynect.net. us-east-1.amazonaws.com name server ns1.p31.dynect.net. us-east-1.amazonaws.com name server ns2.p31.dynect.net. us-east-1.amazonaws.com name server ns4.p31.dynect.net. That's… utterly bizarre to me. us-east-2 has a more diverse selection: $ host -t NS us-east-2.ama…

Same exact thing with EU-WEST-1/2.

  $ dig ns eu-west-1.amazonaws.com +short
  ns3.p31.dynect.net.
  ns1.p31.dynect.net.
  ns4.p31.dynect.net.
  ns2.p31.dynect.net.
  
  $ dig ns eu-west-2.amazonaws.com +short
  u6.amazonaws.com.
  u5.amazonaws.com.
  u2.amazonaws.com.
  u4.amazonaws.com.
  u1.amazonaws.com.
  u3.amazonaws.com.
  pdns1.ultradns.net.
  pdns3.ultradns.org.
  pdns5.ultradns.info.
  ns2.p31.dynect.net.
  ns1.p31.dynect.net.
  ns4.p31.dynect.net.
  ns3.p31.dynect.net.

I wonder why this is, considering the more extended usage that -1 on each region usually gets. :S

Re: DDoS Attack Against Dyn Managed DNS

#153

Post by mtgx » Fri, Oct 21, 2016, 2:53 PM UTC

nickbauman wrote: post #143

scrollaway wrote: post #18

Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)

Prediction: A massive, sustained attack will occur on key US Internet infra on election night in an attempt to debase the US election results.

It's okay. James Comey, the FBI chief, said the US electoral system is such a mess, it would be too hard for an attacker to hack it or damage its integrity in any way. It's all good.

https://www.techdirt.com/articles/20160912/16553435504/fbi-d...

Of course, he said nothing about internal rigging:

https://twitter.com/TweetBrettMac/status/789372518436052992

Re: DDoS Attack Against Dyn Managed DNS

#154

Post by pyvpx » Fri, Oct 21, 2016, 2:54 PM UTC

wsul wrote: post #133

pyvpx wrote: post #120

Earlier quoted context omitted.

they are cheap compared to Neustar. And Neustar is priced like a Bugatti. Dyn is more Porsche pricing.

Check out NS1.

I had a NS1 demo account. And then they stopped doing that, but it still worked. And then I lost the credentials, and now my account is invalid for a password reset :(

Re: DDoS Attack Against Dyn Managed DNS

#155

Post by metaverse » Fri, Oct 21, 2016, 2:55 PM UTC

nixgeek wrote: post #150

metaverse wrote: post #146

While my app isn't resolved using DYN, we are relying on APIs on our EC2 backend that use their DNS. Is there a Linux DNS caching server that will serve from a local cache primarily, and do lookups in the background instead to update the local cache? During the period DYN was down, it would've continued severing from the local cache and retried the background lookups, keeping my app up. I can also see it improving pe…

If you're in us-east-1 then you potentially do actually rely on Dyn even for the amazonaws.com instance hostnames. https://gist.github.com/agh/4e20df0d2d3bfa189477569b77f72e24

Seems then that ELB has a local cache because http requests were reaching my app servers throughout the outage.

Re: DDoS Attack Against Dyn Managed DNS

#156

Post by CodeSheikh » Fri, Oct 21, 2016, 3:05 PM UTC

Let's assume, that foreign countries such as Russia or China would be trying to sabotage our elections on Nov 8th night. What are the severe economic and political backlash that we can deal with if we cut off the traffic coming in from those region (not in a "we control the internet" kinda way)? I am sure they already have nodes operating within the USA. A lot of major tech companies use CDNs that can still serve traffic globally to the consumers of those countries. Even better, how about we regulate and slow down all of incoming traffic for say half day on election day? Is it even possible?

Re: DDoS Attack Against Dyn Managed DNS

#157

Post by AsyncAwait » Fri, Oct 21, 2016, 3:12 PM UTC

rdtsc wrote: post #149

AsyncAwait wrote: post #123

Earlier quoted context omitted.

The usual thinking goes something like; well, the US created the internet so why would they want to take it down? Yes, NSA spies and all that, but they need the internet up to do that and also as bad as NSA is, it's nowhere near as bad as China or Russia where they ... (ranges from censorship to eating babies alive)

> The usual thinking goes something like; well, the US created the internet so why would they want to take it down? To pin it on someone else? "17 Intelligence agencies told me Russia hacked our DNC thing" (Clinton). So maybe it is now "Oh look they took down the whole internet as well".

Of course, I just tried to explain how the thinking behind the sentiment that it obviously isn't the U.S., not saying I agree with it.

Re: DDoS Attack Against Dyn Managed DNS

#158

Post by colanderman » Fri, Oct 21, 2016, 3:31 PM UTC

corobo wrote: post #127

colanderman wrote: post #67

Earlier quoted context omitted.

I'm surprised; I would have thought such large sites would use more than one DNS provider? I mean: $ host -t NS twitter.com twitter.com name server ns4.p34.dynect.net. twitter.com name server ns3.p34.dynect.net. twitter.com name server ns2.p34.dynect.net. twitter.com name server ns1.p34.dynect.net. I would have expected at least one of those to be somewhere else. What is the reason they would not have a backup provid…

I'd guess the reasoning is that DNS providers these days are all anycast-style DNS. A DDoS would usually just be a blip on a few servers around the world depending on where the attacks originate. I'm not saying it's a good reason but it's a reason.

The other reason of course to use two different providers is to mitigate the automatic error propagation issue: https://twitter.com/devops_borat/status/41587168870797312

Re: DDoS Attack Against Dyn Managed DNS

#159

Post by lucaspiller » Fri, Oct 21, 2016, 3:32 PM UTC

jtmarmon wrote: post #4

I'm updating a list of confirmed outages as I see them here https://news.ycombinator.com/item?id=12759520 So far twitter, etsy, soundcloud, spotify, github, pagerduty...crazy that this can even happen

Isn't a major feature of DNS that it can be cached? Why aren't records being returned by ISP/Google DNS/OpenDNS servers? Is their TTL set that low?

Re: DDoS Attack Against Dyn Managed DNS

#160

Post by ksec » Fri, Oct 21, 2016, 3:35 PM UTC

rsa4096 wrote: post #137

dijit wrote: post #116

Earlier quoted context omitted.

Realistically they compete with Neustar which is shockingly expensive and has less features and is harder to use. I chose Dyn over Neustar (UltraDNS) when it was time to renew contracts because it was 60% cheaper, had a better latency, their support was great and the interfaces were clear. Not a fanboy or anything, I really don't like how aggressively they hound me now (even though I have nothing to do with DNS for m…

DNS Made Easy is even cheaper. They have a massive infrastructure and consistently have less latency than either of these providers.

And yet they are not as widely use. I wonder why or am i missing something important.