DNS DDOS Attack against DynDNS knocks out major sites including Github, Twitter & Reddit

eva2000 · Oct 21, 2016

Looks like Github.com isn't only one affected by DDOS attacks against it's upstream DNS provider, DynDNS. It seems sites including Twitter, Reddit, Spotify, Esty, Box, Wix and Squarespace were down DDoS Attack on DNS; Major sites including GitHub, Twitter Suffering Outage

Centmin Mod code hosted on github.com repository is also affected - Centmin Mod github.com repo 504 Timeouts | Centmin Mod Community

In a statement, Dyn acknowledged that their servers are under DDoS attack.

Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time. Updates will be posted as information becomes available. This attack is mainly impacting US East and is impacting Managed DNS customer in this region. Our Engineers are continuing to work on mitigating this issue.
Click to expand...

Imagine a scenario where a DNS provider that is used by Reddit, Twitter or Facebook is under DDoS attack, there is no way a user can visit any of these sites and it looks like that’s what’s going on right now. There are several websites that were down this morning including Twitter, Reddit, Spotify, Esty, Box, Wix Customer Sites Squarespace Customer Sites, Shopify, SoundCloud, Github, Airbnb, Reddit, Freshbooks and Heroku. However, some sites are already coming back online.
Click to expand...

from Dyn, Inc. Status - DDoS Attack Against Dyn Managed DNS

Monitoring
Services have been restored to normal as of 13:20 UTC.
Posted 9 minutes ago. Oct 21, 2016 - 13:36 UTC

Update
This attack is mainly impacting US East and is impacting Managed DNS customers in this region. Our Engineers are continuing to work on mitigating this issue.
Posted about 1 hour ago. Oct 21, 2016 - 12:45 UTC
Click to expand...

eva2000 · Oct 21, 2016

Thinking about it, none of these major web properties/companies have secondary DNS deployed ?

I guess one problem with deploying secondary DNS is if you used a DNS providers' proprietary features and services.

Like with Amazon Route53 they have GeoDNS and Latency based DNS routing features.

DynDNS has Traffic Director and Dynamic Steering.

DNSMadeEasy and their newer sibling Constellix has Geo DNS, Geo Proximity, Geo Priority features

Cloudflare has Traffic Control and Traffic Manager with Geo Steering/Geo Mapping and load balancing feature set.

These unique features aren't exactly easy to replicate from a secondary DNS provider.

eva2000 · Oct 22, 2016

Apparently even Amazon themselves use DynDNS for some services AWS Service Health Dashboard - Oct 21, 2016 PDT or they also got attacked ?

6:36 AM PDT [RESOLVED] Between 4:31 AM and 6:10 AM PDT, we experienced errors resolving the DNS hostnames used to access some AWS services in the US-EAST-1 Region. During the issue, customers may have experienced failures indicating "hostname unknown" or "unknown host exception" when attempting to resolve the hostnames for AWS services and EC2 instances. This issue has been resolved and the service is operating normally.

6:13 AM PDT We have identified the root cause of the issue causing errors resolving the DNS hostnames used to access some AWS services in the US-EAST-1 Region, and are currently working to resolve. Customers may experience failures indicating "hostname unknown" or "unknown host exception" when attempting to resolve the hostnames for AWS services and EC2 instances.

5:51 AM PDT We have identified the root cause of the issue causing errors resolving the DNS hostnames used to access some AWS services in the US-EAST-1 Region, and are currently working to resolve.

5:24 AM PDT We are investigating elevated errors resolving the DNS hostnames used to access some AWS services in the US-EAST-1 Region.
Click to expand...

edit: okay AWS use DynDNS for their service resolution ! Some regions use several providers including their own Route53, DynDNS (dynect.net) and UltraDNS
Code (Text):
host -t NS us-east-1.amazonaws.com
us-east-1.amazonaws.com name server ns4.p31.dynect.net.
us-east-1.amazonaws.com name server ns2.p31.dynect.net.
us-east-1.amazonaws.com name server ns1.p31.dynect.net.
us-east-1.amazonaws.com name server ns3.p31.dynect.net.
Code (Text):
host -t NS us-east-2.amazonaws.com
us-east-2.amazonaws.com name server u4.amazonaws.com.
us-east-2.amazonaws.com name server u6.amazonaws.com.
us-east-2.amazonaws.com name server u3.amazonaws.com.
us-east-2.amazonaws.com name server u2.amazonaws.com.
us-east-2.amazonaws.com name server u1.amazonaws.com.
us-east-2.amazonaws.com name server u5.amazonaws.com.
us-east-2.amazonaws.com name server ns2.p31.dynect.net.
us-east-2.amazonaws.com name server ns1.p31.dynect.net.
us-east-2.amazonaws.com name server pdns1.ultradns.net.
us-east-2.amazonaws.com name server pdns5.ultradns.info.
us-east-2.amazonaws.com name server ns3.p31.dynect.net.
us-east-2.amazonaws.com name server ns4.p31.dynect.net.
us-east-2.amazonaws.com name server pdns3.ultradns.org.
Code (Text):
host -t NS us-west-1.amazonaws.com
us-west-1.amazonaws.com name server u1.amazonaws.com.
us-west-1.amazonaws.com name server pdns5.ultradns.info.
us-west-1.amazonaws.com name server pdns3.ultradns.org.
us-west-1.amazonaws.com name server u2.amazonaws.com.
us-west-1.amazonaws.com name server ns3.p31.dynect.net.
us-west-1.amazonaws.com name server u5.amazonaws.com.
us-west-1.amazonaws.com name server pdns1.ultradns.net.
us-west-1.amazonaws.com name server ns1.p31.dynect.net.
us-west-1.amazonaws.com name server ns4.p31.dynect.net.
us-west-1.amazonaws.com name server ns2.p31.dynect.net.
us-west-1.amazonaws.com name server u6.amazonaws.com.
us-west-1.amazonaws.com name server u4.amazonaws.com.
us-west-1.amazonaws.com name server u3.amazonaws.com.
Github.com is DynDNS only
Code (Text):
host -t NS github.com
github.com name server ns2.p16.dynect.net.
github.com name server ns3.p16.dynect.net.
github.com name server ns4.p16.dynect.net.
github.com name server ns1.p16.dynect.net.

eva2000 · Oct 22, 2016

DDOS attacks against DynDNS started again so more impact on Github.com and thus Centmin Mod hosted git repo code Dyn, Inc. Status - DDoS Attack Against Dyn Managed DNS

Investigating
As of 15:52 UTC, we have begun monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Our Engineers are continuing to work on mitigating this issue.
Posted 5 minutes ago. Oct 21, 2016 - 16:06 UTC
Click to expand...

eva2000 · Oct 22, 2016

these DDOS attacks also made my local television stations nightly news too !

Wonder if these DDOS attacks are to cover up other attempted intrusions like taking advantage of the kernel flaw Security - Kernel Security Update: Local Privilege Escalation CVE-2016-5195 | Centmin Mod Community ?

eva2000 · Oct 22, 2016

Github.com migrated to a different DNS provider GitHub System Status

October 22, 2016
08:10 E. Australia Standard TimeWe are observing normal traffic volume and will continue to monitor. Some users may still be affected while DNS changes propagate.

06:35 E. Australia Standard TimeWe have migrated to an unaffected DNS provider. Some users may experience problems with cached results as the change propagates.
Click to expand...

They moved to using Amazon Route53 DNS
Code (Text):
dig NS +short github.com
ns-1283.awsdns-32.org.
ns-1707.awsdns-21.co.uk.
ns-421.awsdns-52.com.
ns-520.awsdns-01.net.
seems Tokyo & Sydney region has not yet propagated the change at DNS Propagation Checker from Multiple Locations - SolveDNS

and numerous locations tested at Global DNS Propagation Checker - What's My DNS?

eva2000 · Oct 22, 2016

looks like a few also moved to other providers Amazon Route53 DNS

reddit

Code (Text):

dig NS +short reddit.com
ns-1029.awsdns-00.org.
ns-1887.awsdns-43.co.uk.
ns-378.awsdns-47.com.
ns-557.awsdns-05.net.

heroku

Code (Text):

dig NS +short heroku.com
ns-1253.awsdns-28.org.
ns-1538.awsdns-00.co.uk.
ns-405.awsdns-50.com.
ns-975.awsdns-57.net.

airbnb

Code (Text):

dig NS +short airbnb.com
ns-1349.awsdns-40.org.
ns-1548.awsdns-01.co.uk.
ns-446.awsdns-55.com.
ns-696.awsdns-23.net.

eva2000 · Oct 23, 2016

looks like the DDOS attack was another IoT based attack up to 1.2Tbps !

New World Hackers claim responsibility for cyber attack via Twitter

The attacks were carried out partly through the “internet of things” — physical devices like printers and appliances connected to the internet. The hijacked devices had been infected with malware, Dyn said, according to the report. Dyn’s services are part of the infrastructure of the internet, directing users to its client websites.

Members of a shadowy hacker collective that calls itself New World Hackers claimed responsibility for the attack via Twitter.

They said they organised networks of connected “zombie” computers that threw a staggering 1.2 terabits per second of data at the Dyn-managed servers.

“We didn’t do this to attract federal agents, only test power,” two collective members who identified themselves as “Prophet” and “Zain” told an Associated Press reporter via Twitter direct message exchange. They said more than 10 member participated in the attack. It was not immediately possible to verify the claim.

The collective, named NewWorldHacking on Twitter, has in the past claimed responsibility for similar attacks against sites including ESPNFantasySports.com in September and the BBC on December 31. The attack on the BBC marshalled half the computing power of Friday’s onslaught.
Click to expand...

eva2000 · Oct 23, 2016

Dyn has an update Dyn, Inc. Status - Update Regarding DDoS Event Against Dyn Managed DNS on October 21, 2016

Monitoring
Customers seeking additional information pertinent to the incident may reference the following, extended statement: Dyn Statement on 10/21/2016 DDoS Attack
Posted 15 minutes ago. Oct 22, 2016 - 21:30 UTC

Identified
This Preliminary Findings Report is to provide additional detail in connection with an incident that began on October 21, 2016 at approximately 11:10 UTC and lasted until approximately 17:45 UTC

Dyn is dedicated to delivering the highest quality of service, and as such, we take any customer impacting events very seriously. Below you will find a preliminary analysis of the event. A more in-depth analysis will be distributed in the form of a Root Cause Analysis report at a later date.

Service Affected: Managed DNS

Event cause:
On Friday October 21, 2016 at approximately 11:10 UTC, Dyn came under attack by a large Distributed Denial of Service (DDoS) attack against our Managed DNS infrastructure in the US-East region. Customers affected may have seen regional resolution failures in US-East and intermittent spikes in latency globally. Dyn’s engineers were able to successfully mitigate the attack at approximately 13:20 UTC, and shortly after, the attack subsided. See original status post here:Dyn, Inc. Status - DDoS Attack Against Dyn Managed DNS.
At roughly 15:50 UTC a second DDoS attack began against the Managed DNS platform. This attack was distributed in a more global fashion. Affected customers may have seen intermittent resolution issues as well as increased global latency. At approximately 17:00 UTC, our engineers were again able to mitigate the attack and service was restored.

At Dyn, we take every incident seriously and work hard to ensure we deliver the service our customers have come to expect. We will continue to evaluate every situation with the goal of improving our systems and processes to deliver the utmost customer experience. Thank you for your continued support.
Posted about 24 hours ago. Oct 21, 2016 - 22:11 UTC
Click to expand...

Dyn Statement on 10/21/2016 DDoS Attack

eva2000 · Oct 31, 2016

wow that was one big DDOS attack Report: Mirai Botnet DDoSed 17 Dyn Data Centers Globally

All but three data centers where DNS provider Dyn hosts its global infrastructure came under attack in last week’s massive DDoS strike that disrupted some of the internet’s most popular destinations, such as Spotify, Amazon, HBO Now, Twitter, and The New York Times, among others.

Dyn’s servers sit in 20 data centers spread around the world, and the attack — implemented at least in part by using a botnet created by software called Mirai, which hijacks poorly secured IoT devices, such as CCTV cameras and DVRs — was directed at 17 of those sites, according to an analysis byThousandEyes, a provider of global network monitoring services. The three data centers that were not affected are in Warsaw, Beijing, and Shanghai.

“At the height of the attack, approximately 75 percent of our global vantage points sent queries that went unanswered by Dyn’s servers,” Nick Kephart, senior director of product marketing at ThousandEyes, wrote in a blog post. “In addition, the critical nature of many of these affected services led to collateral damage, in terms of outages and performance impacts on sites that are only tangentially related to Dyn (including this blog).”

In addition to bringing light to the fact that the explosion of the Internet of Things will require extra effort to make sure all the devices coming online are secure in order to prevent them from being high-jacked by hackers wholesale, the incident underscores the importance of a multi-vendor strategy when it comes to anything related to core internet infrastructure.
Click to expand...

Log in / Register

Forums

Join the community today

DNS DDOS Attack against DynDNS knocks out major sites including Github, Twitter & Reddit

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

DNS DDOS Attack against DynDNS knocks out major sites including Github, Twitter & Reddit

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.