IoT devices Used in DDoS Attacks
-
@dafyre said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
No different than your EHR moving from Dyn to CloudFlare. Would take like five minutes, literally.
But then it takes hours for those changes to propogate worldwide, doesn't it? Generally I've seen minutes, but it's usually half an hour at best, and I've seen it take as long as 48 hours at worst.
Just a few minutes, generally. At least for most of the world. So you'd solve the 90% within ten minutes, 99% within the hour.
-
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
I understand that, but IF they did, and Dyn was inaccessible, then the EHR provider would not be able to change it until either the attack was mitigated/over or the EHR vendor got someone one the phone at Dyn - but I'm not sure that would even matter... wouldn't the root hints still have to talk to Dyn to get the SOA for the EHR vendor? or is the SOA stored in the root hints, I'm fuzzy on that part.
-
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
-
@dafyre said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
No different than your EHR moving from Dyn to CloudFlare. Would take like five minutes, literally.
But then it takes hours for those changes to propogate worldwide, doesn't it? Generally I've seen minutes, but it's usually half an hour at best, and I've seen it take as long as 48 hours at worst.
Yeah, if you know of a move ahead of time, you can change the TTL to say, 15 minutes, and really speed that up. Doesn't help with something hitting you out of the blue tho.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
I hear University of Pheonix has you covered
-
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
IIRC, and I probably don't, but doesn't Cloudflare do distributed DNS on their own? So a DDoS attack against their DNS infrastructure would be ineffective.
I don't follow. The SOA still has to be on the listed IPs. If all of the listed IPs are being attacked at once, you can't get away from it.
In the case of Dyn, I would assume either A) all of the IPs are behind a singular pipe (horrible design) or there was only one.
-
My EMR vendor has now expanded to 3 DNS providers, and from what I can tell, at least one of them is based in Europe.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
It's not for you to have heard of. It's nothing to do with IT. It's a fundamental business concern. Any business manager should just know this. It's not a technical thing (well, it is... single point of failure, general risk) it's purely standard business knowledge. Really, it's just common sense. The whole system exists the way that it does to make sure you are never stuck with one company owning you.
-
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
It's not for you to have heard of. It's nothing to do with IT. It's a fundamental business concern. Any business manager should just know this. It's not a technical thing (well, it is... single point of failure, general risk) it's purely standard business knowledge. Really, it's just common sense. The whole system exists the way that it does to make sure you are never stuck with one company owning you.
LOL, well except that your registrar does if they decide not to place nice.. but hopefully they would be sued out of existence if that happened.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
It's not for you to have heard of. It's nothing to do with IT. It's a fundamental business concern. Any business manager should just know this. It's not a technical thing (well, it is... single point of failure, general risk) it's purely standard business knowledge. Really, it's just common sense. The whole system exists the way that it does to make sure you are never stuck with one company owning you.
LOL, well except that your registrar does if they decide not to place nice.. but hopefully they would be sued out of existence if that happened.
They don't have that option. It's a requirement of the process.
-
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
It's not for you to have heard of. It's nothing to do with IT. It's a fundamental business concern. Any business manager should just know this. It's not a technical thing (well, it is... single point of failure, general risk) it's purely standard business knowledge. Really, it's just common sense. The whole system exists the way that it does to make sure you are never stuck with one company owning you.
LOL, well except that your registrar does if they decide not to place nice.. but hopefully they would be sued out of existence if that happened.
They don't have that option. It's a requirement of the process.
That's like a requirement of the process that Certificate authorities aren't suppose to mint certs for companies that people don't own.. but then you have horrible systems and these things happen anyhow
-
Where the complexity comes in, is that it's not just simply one IP address being matched to a single domain name.
If that were the case, there wouldn't have been any outages for these websites.
The problem is that there's thousands of IP addresses that are mapped to tens or hundreds of domain names for a single domain, for example, load balancing and other supporting services.
Visit facebook.com and record all network activity. It's not just facebook.com you see, there's x.facebook.com, xyz.facebook.com, etc... It's also not the same IP address for everyone. It get's very complex.
If the authoritative name server for a domain or several domains that support a single domain becomes unavailable, things will be fine until the TTLs expire. Once that happens on the DNS servers down the chain, you don't get the name resolution anymore, and those dns servers can no longer find a path to resolution.
When you combine that with all the other interworkings of a domain, it can be awhile until things get better, even if the attacked name servers get better.
How many of you have ever bought a single domain name and see the message it may take up to 48 hours or whatever to propagate?
The above is pretty a pretty basic explanation and understanding, but I'm just trying to get my point across without making a massive wall of text.
-
@Tim_G does this help:
-
The machines are revolting!
Destroys toaster
-
@ChrisL said in IoT devices Used in DDoS Attacks:
The machines are revolting!
Destroys toaster
Or... the toaster destroys YOU!
-
Gives a new meaning to "you are toast".
-
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Gives a new meaning to "you are toast".
I'm so white, even the lowest setting would burn me to a crisp.
-
@ChrisL said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Gives a new meaning to "you are toast".
I'm so white...
...the toaster thought that it was helping?
-
Chinese electronics firm Hangzhou Xiongmai is set to recall swathes of webcams after they were compromised by the Mirai botnet.
Ā
Mirai exploits the low security standards of internet-connected devices, from routers to webcams, and after enslaving them with malware uses their network connections to launch DDoS attacks, such as that hobbling Dyn's DNS services last week.Sauce of regret: http://www.theregister.co.uk/2016/10/24/chinese_firm_recalls_webcams_over_mirai_botnet_infection_ddos_woes/
