Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

341–350 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#341

Post by detaro »

cjbprime wrote: post #338
toomuchtodo wrote: post #326

Earlier quoted context omitted.

Serving wrong records is usually worse than serving no records. EDIT: It would be fine as long as your site only served HTTPS content and HSTS was enabled for your domain, preventing any sort of MITM attack.

If your DNS server is offline, is the last record it returned when it was online really the "wrong" one? There'd be no right one in that case.

Exactly. You can't know if it is still valid, so you might send clients to an IP that's now controlled by somebody else. Worst case, they know and set up a phishing site. DNS generally has been reliable enough that the trade-off is not worth it.

Re: DDoS Attack Against Dyn Managed DNS

#342

Post by ThrustVectoring »

omni wrote: post #202
barkingcat wrote: post #182

Earlier quoted context omitted.

There are many types of actors even within the USA nation-state / government. For example, if a particular part of the government got wind of a data dump about to be released by another nation-state or independent actor (for example, a leak of some kind) - I think some parts of the USA government that possesses the ability to do so wouldn't hesitate to take down dns to the entire internet to avoid another similar dat…

> wouldn't hesitate to take down dns to the entire internet to avoid another similar data leak to the Snowden dump. I don't understand how this would change anything unless you're assuming they would take down the Internet permanently

It renders the server that's hosting a leak unable to broadcast the leak temporarily, while they arrange more conventional measures to seize it. It's a more rapid response than getting a warrant and a police team on location. The broad nature of the attack also avoids tipping off the server owners.

I still give it less than a 5% probability, though.

Re: DDoS Attack Against Dyn Managed DNS

#343

Post by JoshGlazebrook »

jssjr wrote: post #68

I'm a GitHub employee and want to let everyone know we're aware of the problems this incident is causing and are actively working to mitigate the impact. "A global event is affecting an upstream DNS provider. GitHub services may be intermittently available at this time." is the content from our latest status update on Twitter ( https://twitter.com/githubstatus/status/789452827269664769 ). Reposted here since some peo…

I wish you guys used statuspage or at least allowed email updates for the status of GitHub services.

Re: DDoS Attack Against Dyn Managed DNS

#344

Post by alexmorenodev »

jeppebemad wrote: post #335
dEnigma wrote: post #329

I was not aware of the attacks going on until this happened: 1. Tried to download "Unknown Horizons" (game featured recently on Hacker News) binary, github-link doesn't work. 2. Think "Ok, might be an old link", google their github-repository, github appears down. 3. Try accessing github status website, is down. 4. Interested, try to visit github status twitter account, twitter is down. Really weird experience, norma…

Had a similar experience. When I went to confirm on twitter, that was down too. I was able to acces Twitter from my phone though, where I found a ton of tweets saying "Twitter down!". Strange.

Funny how we're able to tell that twitter's down on twitter, but here in Brazil, when whatsapp was down, nobody could use their own whatsapp to ask or tell if whatsapp was down.

Re: DDoS Attack Against Dyn Managed DNS

#345

Post by cocktailpeanuts »

devy wrote: post #230
heyts wrote: post #205

Earlier quoted context omitted.

I'm in New-York too and can't resolve Paypal, Etsy, Soundcloud, Github, Netflix, Heroku or Twitter

I'm in NYC too. Github.com is resolving/working fine. Netflix.com is resolved but all assets (probably) weren't loading. Additionally Zendesk is also affected.

Github, Twitter, Quora down in Williamsburg. But Gitlab, Stackoverflow is not

Re: DDoS Attack Against Dyn Managed DNS

#346

Post by firstworldman »

balls187 wrote: post #171
curiousgal wrote: post #31

Earlier quoted context omitted.

>We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses. Why not the USA?

Russia retaliating for the US taking out the ESA Mars Drone.

What's this about? Confusing premise. Got any links?

Re: DDoS Attack Against Dyn Managed DNS

#347

Post by Kalium »

cjbprime wrote: post #337
Kalium wrote: post #317

Earlier quoted context omitted.

The rogue ISPs thought they were helping people by serving stale data. After all, better something past its use-by date than failing, right? A low tolerance for DNS response times, and suddenly large chunks of the internet are failing a lot... Among other problems, this enables attacks. Leak a route, DDoS a DNS provider, and watch as traffic everywhere goes to an attack server because servers everywhere "protect" peo…

You seem to be continuing to warn against a proposal that isn't the one that was made. What specifically is dangerous about using cached records only in the case of the upstream servers failing to reply?

The policy that caused so much pain before is to take DNS records, ignore their TTLs, and apply some other arbitrarily selected policy instead. I confess, I don't understand how the proposal at hand is different in ways that prevent the previous pains from recurring.

Maybe you can enlighten me on key differences I've overlooked? How do you define "failing to reply"? Do you ever stop serving records for being stale, or do you store them indefinitely?

Re: DDoS Attack Against Dyn Managed DNS

#348

Post by etherealflux »

castis wrote: post #206
raemike123 wrote: post #176

USA cyber defenses are NOT up to the task of defending our critical electronic infrastructure. Letting every company that runs critical services decide their own security posture is not scalable and has left us vulnerable. While no one is getting hurt, we are taking cyber missile hits from our enemies and eventually the damage will be worse. Other countries with more central controls will be less vulnerable than we a…

> we are taking cyber missile hits A better analogy would be 'mocked cyber mass protests' seeing as how no infrastructure will need to be rebuilt after this passes.

Thankfully, we don't leave in the Star Trek universe, where hacking a computer causes it to explode in a shower of white-hot shrapnel.

Re: DDoS Attack Against Dyn Managed DNS

#350

Post by asdf333 »

bgentry wrote: post #308

If you're having issues with people accessing your running Heroku apps, it's likely because you're running your DNS through herokussl.com (with their SSL endpoint product) which is hosted on Dyn. If you can update your DNS to CNAME directly to the ELB behind it, it should at least make your site accessible.

thanks for the tip! how did you determine the ELB address behind the ssl endpoint?

edit: figured it out. What i did was do:

nslookup your-SSL-endpoint.herokussl.com

then you'll see the elb address.

Switch to the openDNS servers helpfully pointed out by someone above first...

Post reply on HN