Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21 • Hacker News Board

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#41

Post by rlpb » Sat, Oct 22, 2016, 1:20 PM UTC

aexaey wrote: post #36

rlpb wrote: post #28

Earlier quoted context omitted.

If the transaction cost can become insignificantly low, then money could flow in the direction of the victim. Each attack source could end up making a small contribution to the victim's bandwidth bill. I'm not sure economic incentives will lead to this happening. There's also the difficulty in attributing traffic to the person who requested it ("is this a request, so we should bill the packet source, or is this a rep…

Are you suggesting that people should get paid for receiving traffic?

I believe this is what TekMol suggested when he said that the "individual players will make it costly for the other players to send problems their way".

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#42

Post by zer0gravity » Sat, Oct 22, 2016, 1:22 PM UTC

rlpb wrote: post #28

tyingq wrote: post #18

Earlier quoted context omitted.

I think it's being downvoted because it's not a great strategy to address a distributed denial of service. In a DDOS, you have a high number of attack sources, none of them using a great amount of bandwidth on their own. The bandwidth use isn't notable until you get pretty close to the destination. Thus, the costs are (mostly) borne by the victim. Basically it doesn't put the pain where it needs to go.

If the transaction cost can become insignificantly low, then money could flow in the direction of the victim. Each attack source could end up making a small contribution to the victim's bandwidth bill. I'm not sure economic incentives will lead to this happening. There's also the difficulty in attributing traffic to the person who requested it ("is this a request, so we should bill the packet source, or is this a rep…

But wouldn't this make the matter worse ?

Besides all the complications associating with billing, wouldn't this create more incentives for those controlling the botnets to use them in a creative way to actually make money from traffic ?

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#43

Post by tyingq » Sat, Oct 22, 2016, 1:35 PM UTC

zer0gravity wrote: post #33

So I'm wondering, what are the implications of this ? Someone is controlling a powerful enough botnet to do this. How powerfull is it really ? What else can it do ? Was this just a message or a test ? Or both ? What would happen if they would point it to google's nameservers ? What should we expect next ?

From this krebsonsecurity.com post: https://krebsonsecurity.com/2016/10/source-code-for-iot-botn...

According to research from security firm Level3 Communications, the Bashlight botnet currently currently is responsible for enslaving nearly a million IoT devices and is in direct competition with botnets based on Mirai. “Both [are] going after the same IoT device exposure and, in a lot of cases, the same devices,”

So, roughly 1 million IoT devices. And the source code for Mirai is freely available, so there's a DIY kit for anyone to use.

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#44

Post by wwwdonohue » Sat, Oct 22, 2016, 1:43 PM UTC

ComodoHacker wrote: post #4

This attack looks like another probing into critical internet infrastructure Bruce Schneier had talked about. Who's next?

Nothing seems to be loading on YouTube and Hulu this morning, FWIW.

http://downdetector.com/status/hulu http://downdetector.com/status/youtube

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#45

Post by djhworld » Sat, Oct 22, 2016, 1:45 PM UTC

I think it's about time they updated http://dyn.com/ddos/

It was an unprecedented attack, sure, but I'm not sure how their sales guys are going to spin this.

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#46

Post by dendory » Sat, Oct 22, 2016, 1:47 PM UTC

acomjean wrote: post #11

nucotano wrote: post #3

I'm so looking forward at IPv6, the death of NAT, and billions of IoT devices with all ports exposed to the world :-)

Arent most IOT devices behind a router and thus unexposed directly to the internet (excepting routers)? This part of these attacks confuses me.

Pretty much every router is sold with UPnP turned on.

Many IOT devices use UPnP to open their interface to the world.

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#47

Post by eeeeeeeeeeeee » Sat, Oct 22, 2016, 1:48 PM UTC

mjec wrote: post #15

Pardon my ignorance, but why don't companies run their own nameservers? I get why you don't want to run email - it's highly reputation driven. But as far as I can tell, running nameservers is no harder than running webservers or DB servers. HA is potentially even easier, because the system was designed that way from day zero. I'm not suggesting I'd run one for my personal website, but twitter and github are already m…

I've run my own dns infrastructure for a medium sized company. It could get attacked. And you better be sure your providers are OK with the bandwidth usage or they will shut you down. You could be down for hours. If you are targeted it could be very bad.

Amazon and providers like Dyn have Anycast so routing will normally be faster than what most companies would want to spend on their own dns systems. And they can absorb most large attacks. Not to mention that uptime for route 53 is near 100% usually and is pretty cheap. I don't think you could build something cheaper for yourself that offered similar features to route 53.

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#48

Post by neom » Sat, Oct 22, 2016, 1:53 PM UTC

zer0gravity wrote: post #33

So I'm wondering, what are the implications of this ? Someone is controlling a powerful enough botnet to do this. How powerfull is it really ? What else can it do ? Was this just a message or a test ? Or both ? What would happen if they would point it to google's nameservers ? What should we expect next ?

It's complicated because the internet is a complicated(and I'm no expert)- but, it's not good, but it's not insurmountable. The big issues today are: lots of network attached compute, lots of types of traffic, highly highly distributed network. There are numerous ways of mitigating DDoS, today a lot of it is via BGP route announcement[1] - although we've seen folks using BGP in questionable ways to mitigate DDoS recently[2]. As more and more of the internet becomes software defined (like SD WAN sees large global rollout)[3] more and more granular but non-disruptive control will be enabled. To answer your question about google, their DNS is probably resilient enough to deal with a pretty huge attack but who knows really -- In my dream world we get some good neural networks built and deployed to the edge watching for unusual traffic patterns and disrupt them. It used to be biggest pipes win, I don't know that will continue to exclusively be the case.

[1] http://www.enterprisenetworkingplanet.com/netsp/article.php/... [2] https://www.youtube.com/watch?v=LFJzu0AFDpU (Dyn Engineer gave the talk) [3 ]http://www.rcrwireless.com/20160408/telecom-software/using-s...

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#49

Post by zer0gravity » Sat, Oct 22, 2016, 2:01 PM UTC

neom wrote: post #48

zer0gravity wrote: post #33

So I'm wondering, what are the implications of this ? Someone is controlling a powerful enough botnet to do this. How powerfull is it really ? What else can it do ? Was this just a message or a test ? Or both ? What would happen if they would point it to google's nameservers ? What should we expect next ?

It's complicated because the internet is a complicated(and I'm no expert)- but, it's not good, but it's not insurmountable. The big issues today are: lots of network attached compute, lots of types of traffic, highly highly distributed network. There are numerous ways of mitigating DDoS, today a lot of it is via BGP route announcement[1] - although we've seen folks using BGP in questionable ways to mitigate DDoS rece…

> we get some good neural networks built and deployed to the edge watching for unusual traffic patterns and disrupt them

I was thinking at this as well. It's probably under active development right now, if not already live for some.

Re: Update Regarding DDoS Event Against Dyn Managed DNS on Oct 21

#50

Post by driverdan » Sat, Oct 22, 2016, 2:01 PM UTC

mjec wrote: post #15

Pardon my ignorance, but why don't companies run their own nameservers? I get why you don't want to run email - it's highly reputation driven. But as far as I can tell, running nameservers is no harder than running webservers or DB servers. HA is potentially even easier, because the system was designed that way from day zero. I'm not suggesting I'd run one for my personal website, but twitter and github are already m…

The simple answer is that running DNS servers at scale is as hard as running anything else at scale. The cost of having someone else do it for you is often much lower than doing it yourself.