{"id":4321,"date":"2016-10-27T02:26:56","date_gmt":"2016-10-26T18:26:56","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=4321"},"modified":"2016-10-27T13:01:15","modified_gmt":"2016-10-27T05:01:15","slug":"dyn-dns-ddos-killed-half-internet","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2016\/10\/dyn-dns-ddos-killed-half-internet\/","title":{"rendered":"The Dyn DNS DDoS That Killed Half The Internet"},"content":{"rendered":"<p>Last week the Dyn DNS DDoS took out most of the East coast US websites including monsters like Spotify, Twitter, Netflix, Github, Heroku and many more.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/10\/The-Dyn-DNS-DDoS-That-Killed-Half-The-Internet-640x320.png\" alt=\"The Dyn DNS DDoS That Killed Half The Internet\" width=\"640\" height=\"320\" class=\"aligncenter size-medium wp-image-4322\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/10\/The-Dyn-DNS-DDoS-That-Killed-Half-The-Internet-640x320.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/10\/The-Dyn-DNS-DDoS-That-Killed-Half-The-Internet-1024x512.png 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/10\/The-Dyn-DNS-DDoS-That-Killed-Half-The-Internet-1536x768.png 1536w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2016\/10\/The-Dyn-DNS-DDoS-That-Killed-Half-The-Internet.png 1640w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<p>Hopefully it wasn&#8217;t because I shared the <a href=\"https:\/\/www.darknet.org.uk\/2016\/10\/mirai-ddos-malware-source-code-leaked\/\">Mirai source code<\/a> and some script kiddies got hold of it and decided to take half of the US websites out.<\/p>\n<blockquote><p>A denial of service attack against managed DNS provider Dyn restricted access to many US-based websites on Friday.<\/p>\n<p>The ongoing attack is affecting Dyn\u2019s managed DNS customers on the US East Coast, according to the provider, which adds on its status page that its \u201cengineers are continuing to work on mitigating this issue\u201d.<\/p>\n<p>    Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time.<\/p>\n<p>The strength of the attack, as well as its source, remains unclear. Sites experiencing issues as a result of the attack include Github, Airbnb, Reddit, Freshbooks, Heroku and Vox Media properties. SoundCloud, Spotify and Shopify have also been affected. The sites themselves are fine but DNS lookups may be slow, leading to problems.<\/p><\/blockquote>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>It&#8217;s estimated 50,000-100,000 bots (mostly IoT devices) took part in the attack, which with pretty much everyone on highspeed broadband now is a LOT of bandwidth with some people speculating in the 1.2 Tbps range.<\/p>\n<p>People are also speculating that it seems to be another attack directed at the PlayStation Netowork (PSN) which uses the same DNS service and the outages could have been a byproduct of an attack aimed at Sony.<\/p>\n<p>DDoS attacks on PSN and Xbox Live are not super uncommon as they are basically skiddie breeding\/trolling\/flame grounds with lots of bored teenagers, many of which would be technically savvy.<\/p>\n<blockquote><p>Richard Meeus, VP technology EMEA at NSFOCUS, a DDoS mitigation company, commented: \u201dDNS has often been neglected in terms of its security and availability from an enterprise perspective \u2013 it is treated as if it will always be there in the same way that water comes out of the tap and electricity is there when you switch it on.<\/p>\n<p>\u201cThis attack highlights how critical DNS is to maintaining a stable and secure internet presence, and that the DDOS mitigation processes businesses have in place are just as relevant to their DNS service as it is to the web servers and data centres,\u201d he added.<\/p><\/blockquote>\n<p>You can see the official Dyn statement here: <a href=\"https:\/\/www.dynstatus.com\/incidents\/nlr4yrr162t8\">DDoS Attack Against Dyn Managed DNS<\/a><\/p>\n<p>And their analysis: <a href=\"http:\/\/dyn.com\/blog\/dyn-analysis-summary-of-friday-october-21-attack\/\">Dyn Analysis Summary Of Friday October 21 Attack<\/a><\/p>\n<p>I suspect there is more of this to come, and at some point someone is probably going to manage to break the entire Internet.<\/p>\n<p>Source: <a href=\"http:\/\/www.theregister.co.uk\/2016\/10\/21\/dns_dyn_ddos\/\">The Register<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last week the Dyn DNS DDoS took out most of the East coast US websites including monsters like Spotify, Twitter, Netflix, Github, Heroku and many more. Hopefully it wasn&#8217;t because I shared the Mirai source code and some script kiddies got hold of it and decided to take half of the US websites out. A [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Last week the Dyn DNS DDoS took out most of the East coast US websites including monsters like Spotify, Twitter, Netflix, Github, Heroku and many more.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1,5],"tags":[54,9821,6641,4146],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4321"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=4321"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/4321\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=4321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=4321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=4321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}