The Dyn DNS DDoS That Killed Half The Internet

Outsmart Malicious Hackers


Last week the Dyn DNS DDoS took out most of the East coast US websites including monsters like Spotify, Twitter, Netflix, Github, Heroku and many more.

The Dyn DNS DDoS That Killed Half The Internet

Hopefully it wasn’t because I shared the Mirai source code and some script kiddies got hold of it and decided to take half of the US websites out.

A denial of service attack against managed DNS provider Dyn restricted access to many US-based websites on Friday.

The ongoing attack is affecting Dyn’s managed DNS customers on the US East Coast, according to the provider, which adds on its status page that its “engineers are continuing to work on mitigating this issue”.

Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time.

The strength of the attack, as well as its source, remains unclear. Sites experiencing issues as a result of the attack include Github, Airbnb, Reddit, Freshbooks, Heroku and Vox Media properties. SoundCloud, Spotify and Shopify have also been affected. The sites themselves are fine but DNS lookups may be slow, leading to problems.


It’s estimated 50,000-100,000 bots (mostly IoT devices) took part in the attack, which with pretty much everyone on highspeed broadband now is a LOT of bandwidth with some people speculating in the 1.2 Tbps range.

People are also speculating that it seems to be another attack directed at the PlayStation Netowork (PSN) which uses the same DNS service and the outages could have been a byproduct of an attack aimed at Sony.

DDoS attacks on PSN and Xbox Live are not super uncommon as they are basically skiddie breeding/trolling/flame grounds with lots of bored teenagers, many of which would be technically savvy.

Richard Meeus, VP technology EMEA at NSFOCUS, a DDoS mitigation company, commented: ”DNS has often been neglected in terms of its security and availability from an enterprise perspective – it is treated as if it will always be there in the same way that water comes out of the tap and electricity is there when you switch it on.

“This attack highlights how critical DNS is to maintaining a stable and secure internet presence, and that the DDOS mitigation processes businesses have in place are just as relevant to their DNS service as it is to the web servers and data centres,” he added.

You can see the official Dyn statement here: DDoS Attack Against Dyn Managed DNS

And their analysis: Dyn Analysis Summary Of Friday October 21 Attack

I suspect there is more of this to come, and at some point someone is probably going to manage to break the entire Internet.

Source: The Register


Posted in: General Hacking, Network Hacking

, , , , , , , ,

Recent in General Hacking:
- Fully Integrated Defense Operation (FIDO) – Automated Incident Response
- BADLOCK – Are ‘Branded’ Exploits Going Too Far?
- Dradis – Reporting Platform For IT Security Professionals

Related Posts:

Most Read in General Hacking:
- 10 Best Security Live CD Distros (Pen-Test, Forensics & Recovery) - 1,173,729 views
- Hack Tools/Exploits - 634,496 views
- Password Cracking with Rainbowcrack and Rainbow Tables - 438,702 views


One Response to The Dyn DNS DDoS That Killed Half The Internet

  1. Derek Callaway October 29, 2016 at 9:08 am #

    The PlayStation network targeting theory is plausible, but unless someone confesses or publishes some digital forensic evidence it’s going to be impossible to prove one way or another. When I was a script kiddie on PPP dial-up, Soldier (pepsi.c UDP echo service flood tool author) ran a traceroute on me and exhausted all of the bandwidth available to the ISP’s CSU/DSU connecting their T1 to Cisco IOS. Hey, at least I didn’t get caught right?! :-D Well, the next time my personal IP address got attacked with Trinoo and again the entire provider went down and this time for the entire weekend. When a system administrator checked the logs, obviously my IP is there plain as day which got tied back to the Livingston Portmaster’s ComOS RADIUS logs. That’s the story of an old account getting disabled (at least until I starting working there.) The moral is that you can’t necessarily know who’s being targeted or why without some sort of voluntary communication. Will we ever see any traffic logs for the current DynDNS DDoS fiasco?

Leave a Reply