Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

291–300 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#291
post #117
post #104

Earlier quoted context omitted.

This is what you can do to restore your GitHub access: grep github ~/.ssh/known_hosts sudo vim /etc/hosts sudo killall -HUP mDNSResponder ping github.com

Why am I being downvoted for providing useful information? I don't understand HN...

If you're attempting to understand the behavior of individual users of HN as a collective, I can assure you that your initial principles are hampering you greatly.

Re: DDoS Attack Against Dyn Managed DNS

#292
post #249

Earlier quoted context omitted.

Historically, doing this has been a source of a truly awe-inspiring amount of pain.

Aw, don't leave us hanging like that. What problems did it cause?

Imagine migrating your website to a new host. A month later, you learn that a major ISP has decided that its customers don't need to know about the move, because they hold on to last-known-good records as they like. So half your traffic and business is gone. Or maybe you can't use anything run on Heroku, because the dynamicism there doesn't play nice with your resolver's policies.

That's the kind of world we used to live in when TTLs were often treated as vague suggestions.

Re: DDoS Attack Against Dyn Managed DNS

#293

I've been singing the praise of AWS Route53 for a long time, they up and running. I can't believe major multi-million dollar companies (Twitter, GitHub, Soundcloud, Pagerduty) would not run a mix of multiple DNS providers. Also what is happening is a cascade effect, where a 3rd party being down effects others.

> I've been singing the praise of AWS Route53 for a long time, they up and running.

I'm a fan of Route53, too.

But can we say that it weathered the attack? Or was it just lucky that its systems weren't targeted?

Re: DDoS Attack Against Dyn Managed DNS

#295
post #25

Using Google Public DNS fixed things for me.

I'm using Google Public DNS too. I don't really know if there is a relation with DynDNS but I'm still experiencing issues in GitHub and Twitter, like partial loading of images.

Perhaps Google had old (but valid) records still in their cache for a while. Google DNS was working for me for a while, and then stopped. Apparently Dyn has the problem fixed, but maybe there is some TTL based propagation delays still. I updated my internal network to use Dyn's internet guide/public DNS and the problem is fixed.

Maybe this is their strategy: we break it, you buy it ;)

https://help.dyn.com/internet-guide-setup/

If you can't load that page, the public DNS servers are: 216.146.35.35, 216.146.36.36

Re: DDoS Attack Against Dyn Managed DNS

#298
post #243

Earlier quoted context omitted.

I'm not sure I understand what you're saying. The scenario is that my local network's caching DNS resolver retains resolutions beyond the authority-provided TTL in the event that a TTL-specified refresh at expiration fails. Therefore, my web browser may—in the very rare situation where this arises—make an HTTP request to an IP address of a server that has been intentionally moved by a service provider (let's assume t…

One possible issue is that IPs are re-used in cloud environments. Potentially, your browser could POST sensitive data to an IP address that now belongs to a totally different company.

Yeah, that is definitely possible.

I mean, hopefully it is over HTTPS so they can't do anything with it... but if it isn't then it can definitely happen. Our servers get random web traffic all of the time.

Re: DDoS Attack Against Dyn Managed DNS

#299
post #267

Earlier quoted context omitted.

That was exactly my thought. This may be unrelated, or it may be a test run. But a large scale attack on Election Day that crippled communications would stir up unrest for a variety of reasons. Although I think that's highly unlikely to change the outcome, unrest after such a contentious election is not good.

If this is a test run, this is an amazing early warning for Twitter and the like to immediately start working on contingency plans for election day.

What can they do? It's not Twitter themselves being DDOS'd, it's a DNS provider. This propagates up the chain to impact both a Tier 1 network and cloud providers, which hits tons of stuff on top of that.

Re: DDoS Attack Against Dyn Managed DNS

#300
post #55

Earlier quoted context omitted.

>We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses. Why not the USA?

It doesn't make a whole lot of sense for the USA to take down the internet, as they benefit the most from it. A significant fraction of that economy is based on it, much larger than in the cases of China and Russia. It would be like the owner of a coal mine campaigning for a carbon emissions tax: maybe there's something we don't know, but from the information we have it seems unlikely. Note that this wouldn't rule ou…

It would be like the owner of a coal mine campaigning for a carbon emissions tax

Not necessarily so strange. See https://en.wikipedia.org/wiki/Bootleggers_and_Baptists for instance.

Post reply on HN