Distributed Denial Of Service (DDoS) attack

[bwframe]

This Is Probably Why Half the Internet Shut Down Today*[Update: It?s Happening Again]

Cyberattack Knocks Out Access to Websites - WSJ

Twitter, Spotify and Reddit are among major sites taken OFFLINE in massive shock cyber attack | Daily Mail Online

https://techcrunch.com/2016/10/21/many-sites-including-twitter-and-spotify-suffering-outage/


Major internet services, including Twitter and Spotify, are suffering massive outages today as a US internet provider comes under cyber attack.

The internet service company Dyn said that it had suffered a denial of service (DDoS) attack on its domain name service shortly after 6AM ET (11AM BST).

The outages mostly affected the east coast of the US, and a second attack was believed to be underway at 1PM ET.
It was not immediately clear who was responsible and Gillian Christensen of the U.S. Department of Homeland Security said the agency was 'investigating all potential causes.'

 

[T.Lex]

Where's Al Gore when we need him.

 

[pudly]

DDoS attacks certainly aren't new. They in fact are pretty much a continuous fact of life on the Internet. It is just a question of who are the current target(s) to determine how likely it is to be publicized.

There are millions of hacked computers and computer-containing devices (all those "smart" devices/Internet-of-Things) that are used in various attacks. Your "smart" TVs, home routers, internet-connected video cameras, etc, etc. are all potential participants in this attack. The Internet of Things is horrendously insecure. The vast majority of such devices have no way to apply security updates to their software, have poor security design, published default passwords, etc. that make them easy to take over and repurpose to perform functions other than you think they are doing.

 

[HoughMade]

Where's Al Gore when we need him.

I have no idea, but I bet he's eating.

 

[T.Lex]

DDoS attacks certainly aren't new. They in fact are pretty much a continuous fact of life on the Internet. It is just a question of who are the current target(s) to determine how likely it is to be publicized.

Yes, but in fairness, this seems of a larger scale and "better" targeted than what script kiddies can achieve.

I haven't seen a source for how this is one is being conducted - bad pings seems unlikely.

 

[femurphy77]

Where's Al Gore when we need him.

I have no idea, but I bet he's eating.

There can only be one possibility to why Al is nowhere to be seen. . .

 

[pudly]

Yes, but in fairness, this seems of a larger scale and "better" targeted than what script kiddies can achieve.

I haven't seen a source for how this is one is being conducted - bad pings seems unlikely.

Major DDoS attacks have never been the realm of script kiddies.

The state of the art is from state actors and cyber criminals. Pings are old news for DoS attacks. They don't have the volume of modern attacks and are more easily traceable back to the sources.

Current attacks are far larger volume and harder to trace. They likely use some variation of a reflection attack. You send a series of queries from a hacked internet-connected device to a legitimate server with a forged "from" address- one pointing to your target instead of yourself. So, for every request you send to the server, it returns a much larger response to the targeted system. This makes the originator harder to identify and increases the power of the attack. Multiply this by thousands of requests/second from hundreds of thousands of owned computers and you can overwhelm pretty much any service out there.

This type of "service" can be contracted for a nominal amount and pointed against whoever you want to hit. It has been used commonly to blackmail commercial sites, block political targets and other uses. Like I said. It isn't new and it isn't novel. It is just a question of who the blast is pointed at to determine how much it is noticed by the public.

 

[T.Lex]

Jokes, my friend.

This appears targeted at deeper than just a set of sites, but at Dyn infrastructure itself.

Test run? Maybe seeing what opens up when they clog all the normal stuff? Wonder why they picked today. A Monday seems like it'd be more impactful.

 

[T.Lex]

Krebs has a good article.

https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/

This could be a big counterattack in the hackers v. security dudes struggle. That'd be kinda wild.

 

[padawan]

There can only be one possibility to why Al is nowhere to be seen. . .

I thought you were talking about man-bear-pig?

 

[JettaKnight]

My guess is a test run in preparation for ????

Chicoms? Russians? Anonymouse? I don't think the DPRK has the bandwidth to do much of anything.

 

[pudly]

Krebs has a good article.

https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/

This could be a big counterattack in the hackers v. security dudes struggle. That'd be kinda wild.

Krebs would know as well as anyone. He's a well known and regarded cyber-security guy who was recently the target of the largest DDoS attacks ever measured.

 

[JettaKnight]

I thought you were talking about man-bear-pig?

No jokes right now, this is serial.

 

[pudly]

My guess is a test run in preparation for ????

Chicoms? Russians? Anonymouse? I don't think the DPRK has the bandwidth to do much of anything.

Although it could be a state actor, the really scary thing is that it could be a much smaller group, such as some hackers who's assembled a large botnet that they can use to blast whoever they want. They don't use their own servers to blast out the DDoS attack, so it is much harder to trace who is actually responsible.

 

[KellyinAvon]

My guess is a test run in preparation for ????

Chicoms? Russians? Anonymouse? I don't think the DPRK has the bandwidth to do much of anything.

Anonymouse? Disney might be behind this??

 

[opus1776]

No jokes right now, this is serial.

Just imagine how bad it would be if it were parallel......
















======================================
"Nothing tastes as good as skinny feels" K. Moss
You can NEVER be too rich or too thin.
Life is not a journey, but a series of unplanned detours...
Perfection: is not a goal---it's a demanded expectation.

 

[printcraft]

Can't get to my supplier portal for Chrysler.........

 

[bwframe]

Half of the sites I've searched for or have been in the process of using today have timed out numerous times.

 

[printcraft]

I have to wonder if this is response to the diplomacy plan john ****ing kerry announced a couple of days ago?

 

[femurphy77]

No jokes right now, this is serial.

Super Serial!