The Dyn DNS DDoS That Killed Half The Internet

Keep on Guard!


Last week the Dyn DNS DDoS took out most of the East coast US websites including monsters like Spotify, Twitter, Netflix, Github, Heroku and many more.

The Dyn DNS DDoS That Killed Half The Internet

Hopefully it wasn’t because I shared the Mirai source code and some script kiddies got hold of it and decided to take half of the US websites out.

A denial of service attack against managed DNS provider Dyn restricted access to many US-based websites on Friday.

The ongoing attack is affecting Dyn’s managed DNS customers on the US East Coast, according to the provider, which adds on its status page that its “engineers are continuing to work on mitigating this issue”.

Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time.

The strength of the attack, as well as its source, remains unclear. Sites experiencing issues as a result of the attack include Github, Airbnb, Reddit, Freshbooks, Heroku and Vox Media properties. SoundCloud, Spotify and Shopify have also been affected. The sites themselves are fine but DNS lookups may be slow, leading to problems.


It’s estimated 50,000-100,000 bots (mostly IoT devices) took part in the attack, which with pretty much everyone on highspeed broadband now is a LOT of bandwidth with some people speculating in the 1.2 Tbps range.

People are also speculating that it seems to be another attack directed at the PlayStation Netowork (PSN) which uses the same DNS service and the outages could have been a byproduct of an attack aimed at Sony.

DDoS attacks on PSN and Xbox Live are not super uncommon as they are basically skiddie breeding/trolling/flame grounds with lots of bored teenagers, many of which would be technically savvy.

Richard Meeus, VP technology EMEA at NSFOCUS, a DDoS mitigation company, commented: ”DNS has often been neglected in terms of its security and availability from an enterprise perspective – it is treated as if it will always be there in the same way that water comes out of the tap and electricity is there when you switch it on.

“This attack highlights how critical DNS is to maintaining a stable and secure internet presence, and that the DDOS mitigation processes businesses have in place are just as relevant to their DNS service as it is to the web servers and data centres,” he added.

You can see the official Dyn statement here: DDoS Attack Against Dyn Managed DNS

And their analysis: Dyn Analysis Summary Of Friday October 21 Attack

I suspect there is more of this to come, and at some point someone is probably going to manage to break the entire Internet.

Source: The Register

Posted in: Hacking News, Networking Hacking

, , ,


Latest Posts:


Terabytes Of US Military Social Media Spying S3 Data Exposed Terabytes Of US Military Social Media Spying S3 Data Exposed
Once again the old, default Amazon AWS S3 settings are catching people out, the US Military has left terabytes of social media spying S3 data exposed.
SNIFFlab - Create Your Own MITM Test Environment SNIFFlab – Create Your Own MITM Test Environment
SNIFFlab is a set of scripts in Python that enable you to create your own MITM test environment for packet sniffing through a WiFi access point.
Skype Log Viewer Download - View Logs on Windows Skype Log Viewer Download – View Logs on Windows
Skype Log Viewer allows you to download and view the Skype history and log files, on Windows, without actually downloading the Skype client itself.
Ethereum Parity Bug Destroys Over $250 Million In Tokens Ethereum Parity Bug Destroys Over $250 Million In Tokens
If you are into cryptocurrency or blockchain at all, you will have heard about the Ethereum Parity Bug that has basically binned $280 Million + ETH.
WPSeku - Black-Box Remote WordPress Security Scanner WPSeku – Black-Box Remote WordPress Security Scanner
WPSeku is a black box WordPress Security scanner that can be used to scan remote WordPress installations to find security issues and vulnerabilities.
Malaysia Telco Hack - Corporations Spill 46 Million Records Malaysia Telco Hack – Corporations Spill 46 Million Records
The Malaysia Telco Hack has been blowing up in the news with over 42 Million Records being leaked including IMEI numbers, SIM details and home addresses.


One Response to The Dyn DNS DDoS That Killed Half The Internet

  1. Derek Callaway October 29, 2016 at 9:08 am #

    The PlayStation network targeting theory is plausible, but unless someone confesses or publishes some digital forensic evidence it’s going to be impossible to prove one way or another. When I was a script kiddie on PPP dial-up, Soldier (pepsi.c UDP echo service flood tool author) ran a traceroute on me and exhausted all of the bandwidth available to the ISP’s CSU/DSU connecting their T1 to Cisco IOS. Hey, at least I didn’t get caught right?! :-D Well, the next time my personal IP address got attacked with Trinoo and again the entire provider went down and this time for the entire weekend. When a system administrator checked the logs, obviously my IP is there plain as day which got tied back to the Livingston Portmaster’s ComOS RADIUS logs. That’s the story of an old account getting disabled (at least until I starting working there.) The moral is that you can’t necessarily know who’s being targeted or why without some sort of voluntary communication. Will we ever see any traffic logs for the current DynDNS DDoS fiasco?