The Dyn DNS DDoS That Killed Half The Internet

Outsmart Malicious Hackers


Last week the Dyn DNS DDoS took out most of the East coast US websites including monsters like Spotify, Twitter, Netflix, Github, Heroku and many more.

The Dyn DNS DDoS That Killed Half The Internet

Hopefully it wasn’t because I shared the Mirai source code and some script kiddies got hold of it and decided to take half of the US websites out.

A denial of service attack against managed DNS provider Dyn restricted access to many US-based websites on Friday.

The ongoing attack is affecting Dyn’s managed DNS customers on the US East Coast, according to the provider, which adds on its status page that its “engineers are continuing to work on mitigating this issue”.

Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time.

The strength of the attack, as well as its source, remains unclear. Sites experiencing issues as a result of the attack include Github, Airbnb, Reddit, Freshbooks, Heroku and Vox Media properties. SoundCloud, Spotify and Shopify have also been affected. The sites themselves are fine but DNS lookups may be slow, leading to problems.


It’s estimated 50,000-100,000 bots (mostly IoT devices) took part in the attack, which with pretty much everyone on highspeed broadband now is a LOT of bandwidth with some people speculating in the 1.2 Tbps range.

People are also speculating that it seems to be another attack directed at the PlayStation Netowork (PSN) which uses the same DNS service and the outages could have been a byproduct of an attack aimed at Sony.

DDoS attacks on PSN and Xbox Live are not super uncommon as they are basically skiddie breeding/trolling/flame grounds with lots of bored teenagers, many of which would be technically savvy.

Richard Meeus, VP technology EMEA at NSFOCUS, a DDoS mitigation company, commented: ”DNS has often been neglected in terms of its security and availability from an enterprise perspective – it is treated as if it will always be there in the same way that water comes out of the tap and electricity is there when you switch it on.

“This attack highlights how critical DNS is to maintaining a stable and secure internet presence, and that the DDOS mitigation processes businesses have in place are just as relevant to their DNS service as it is to the web servers and data centres,” he added.

You can see the official Dyn statement here: DDoS Attack Against Dyn Managed DNS

And their analysis: Dyn Analysis Summary Of Friday October 21 Attack

I suspect there is more of this to come, and at some point someone is probably going to manage to break the entire Internet.

Source: The Register


Posted in: Hacking News, Networking Hacking

, , ,

Latest Posts:


BSQLinjector - Blind SQL Injection Tool Download BSQLinjector – Blind SQL Injection Tool Download in Ruby
BSQLinjector is an easy to use Blind SQL Injection tool in Ruby, that uses blind methods to retrieve data from SQL databases.
CCleaner Hack - Spreading Malware To Specific Tech Companies CCleaner Hack – Spreading Malware To Specific Tech Companies
The CCleaner Hack is blowing up, initially estimated to be huge, it's hit at least 700k computers & is specifically targeting 20 top tech organisations.
AWSBucketDump - AWS S3 Security Scanning Tool AWSBucketDump – AWS S3 Security Scanning Tool
AWSBucketDump is an AWS S3 Security Scanning Tool, which allows you to quickly enumerate AWS S3 buckets to look for interesting or confidential files.
nbtscan Download - NetBIOS Scanner For Windows & Linux nbtscan Download – NetBIOS Scanner For Windows & Linux
nbtscan is a command-line NetBIOS scanner for Windows that is SUPER fast, it scans for open NetBIOS nameservers on a local or remote TCP/IP network.
Equifax Data Breach - Hack Due To Missed Apache Patch Equifax Data Breach – Hack Due To Missed Apache Patch
The Equifax data breach is pretty huge with 143 million records leaked from the hack in the US alone with unknown more in Canada and the UK.
Seth - RDP Man In The Middle Attack Tool Seth – RDP Man In The Middle Attack Tool
Seth is an RDP Man In The Middle attack tool written in Python to MiTM RDP connections by attempting to downgrade the connection to extract clear text creds


One Response to The Dyn DNS DDoS That Killed Half The Internet

  1. Derek Callaway October 29, 2016 at 9:08 am #

    The PlayStation network targeting theory is plausible, but unless someone confesses or publishes some digital forensic evidence it’s going to be impossible to prove one way or another. When I was a script kiddie on PPP dial-up, Soldier (pepsi.c UDP echo service flood tool author) ran a traceroute on me and exhausted all of the bandwidth available to the ISP’s CSU/DSU connecting their T1 to Cisco IOS. Hey, at least I didn’t get caught right?! :-D Well, the next time my personal IP address got attacked with Trinoo and again the entire provider went down and this time for the entire weekend. When a system administrator checked the logs, obviously my IP is there plain as day which got tied back to the Livingston Portmaster’s ComOS RADIUS logs. That’s the story of an old account getting disabled (at least until I starting working there.) The moral is that you can’t necessarily know who’s being targeted or why without some sort of voluntary communication. Will we ever see any traffic logs for the current DynDNS DDoS fiasco?