Slashdot Log In
EveryDNS Under Botnet DDoS Attack
Posted by
kdawson
on Sat Dec 02, 2006 09:03 PM
from the man-that-smarts dept.
from the man-that-smarts dept.
mellow marsh writes "EveryDNS, sister company to OpenDNS (which runs the PhishTank anti-phishing initiative), has been hit by a massive distributed denial-of-service attack. The attack started sometime Friday afternoon and, from all indications, was targeting Web sites that used free DNS management services provided by EveryDNS. At the height of the DDoS bombardment, EveryDNS was being hit with more than 400mbps of traffic at each of its four locations around the world. From the article: '"We were collateral damage," Ulevitch explained... Because law enforcement is involved, Ulevitch was hesitant to release details of the actual target but there are signs that some of the targets were "nefarious domains" that have since been terminated.'" OpenDNS, which makes use of EveryDNS services, was affected for a time, until they spread their authoritative DNS more broadly. The EveryDNS site is now reporting that the attack is continuing but has been mitigated and is not affecting operations.
Related Stories
[+]
Technology: PhishTank Taps Community To ID Scams 58 comments
mikesd81 writes, "The AP has an article on PhishTank, OpenDNS's service for fighting e-mail fraud. The free service seeks to tap the wisdom of the Internet community in identifying phishing emails and sites." From the article: "Users simply submit to PhishTank.com the messages they believe are scams. Others then examine the message and the site to which it links and decide whether it is or isn't a scam. When an item gets enough votes and the margin is wide enough, it is either dropped or classified as a phishing message. To prevent scammers from trying to game the system, votes are weighed based on how long, how often, and how accurate one has rated other messages." Update: 10/05 18:24 GMT by kd : David Ulevitch wrote to mention: "PhishTank, unlike any other anti-phishing service, provides a full API and open access to the data for any developer to use to secure their applications. Before PhishTank, someone from the SpamAssassin project or maybe the Squid Cache would have to fork over a lot of money for phishing data to groups like the Anti Phishing Working Group or Symantec. It's now available for free, and I believe in a far more accurate and usable form."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
puppy (Score:5, Funny)
Re: (Score:2)
COM != NET (Score:3, Informative)
Re:COM != NET (Score:4, Informative)
Another quality, editor approved Slashdot story. Great job, guys.
Parent
Affected; Irony (Score:2, Interesting)
My comp sci networking class assignment was on my home server, and I use EasyDNS. Had to bus home and put it on a USB stick. Last day of class, and the end of a particularly brutal week.
Re: (Score:2, Funny)
correct URL (Score:4, Informative)
Re: (Score:2, Insightful)
Does that mean (Score:2)
Heh (Score:5, Informative)
I'll keep it up for Slashdot, let me just move it around a bit.
-david
Re:Heh (Score:5, Funny)
Parent
Link To Them (Score:2, Funny)
Questions? (Score:5, Informative)
If you have questions about this or DDoS in general, feel free to ask them here and I'll make sure to cover them in my response. I'll be writing about what we've seen and what I generally do when it comes to soaking up traffic and how we handled this event in particular. (The short answer: find the smartest people you can to help you and then start taking corrective action)
Thanks!
David Ulevitch
Re:Questions? (Score:4, Insightful)
Was this a 'righteous' attack on malicious websites?
Or just some intramural warfare by one nefarious group upon another?
Parent
Re:Questions? (Score:5, Interesting)
Parent
You must be new here (Score:2)
A Slashdotting is always Righteous
/Don't hate me because my UID is prime
Re: (Score:2)
Re: (Score:2)
Global Stats:
Accounts: 62357
Domains: 103552
Records: 292615
The implementation details are in the FAQ and About. Without bothering to read them again, I think they use a modified tinydns.
Re: (Score:2)
Re:Questions? (Score:4, Informative)
That's less trivial to filter, especially when your upstream isn't being cooperative. In our case, which you'll read about tomorrow or Monday, we quickly were able to jump onto a network run by some folks with very very high levels of clue; nLayer operated by Richard Steenbergen. Their website is cheesy -- don't let it fool you. They are a seriously run network providing transit across the country to a bunch of other networks. Check routeviews for proof.
-david
Parent
Re:Questions? (Score:5, Interesting)
1. How did you manage the response? The one-smart-person-in-charge-who-stays-awake-the-wh
2. What tactics worked, and even more important, what didn't work?
3. What sort of agreements should people have in place with their upstream ISP prior to an incident?
4. How intelligent was the attack traffic? Randomized payload? Does anyone bother spoofing addresses any more?
5. Was it a guided attack or a fire and forget? In other words, did the scum make any changes to their tactics in real time as you tried corrective action?
6. What if anything can be done in the first few minutes/hours?
7. If you had to choose between capacity and filtering, which would you choose?
Parent
Real ripple effects, even from this small event. (Score:5, Insightful)
Worse, the state government box's spam filtering appliance blacklisted the retailer's server, and a third party admin had to get involved to free things up. Quite a mess.
But the real lesson? People who say that a "cyber attack" couldn't really hurt the economy are wrong, wrong, wrong. This stuff can be really disruptive, and this was a pissant little scaled-down example. No major damage, but a lot of thrashing around, untold manhours of lost productivity, and (in the case of the anecdote in question, involving just one retail company), probably some tax fines which will require much tail chasing to get waived once the the story is clearly told, assuming the state government in question is feeling sporting about it.
Re:Real ripple effects, even from this small event (Score:2)
I could cause a lot more problems and not do anything illegal. Shoud those acts be illegal because of a butterfly effect caused by bad programming? Get real, please.
Re: (Score:2)
If by "bad programming" you mean: the DDoS attack on the name servers was working, and thus a receiving mail server couldn't decide whether to trust another party's sent message... then, sure. Except that's not bad programming "on the site" (as you put it), is it? No. It's a vulnerability in using DNS in the first place. The only thing that would have prevented that would have been sticking with good old
Re: (Score:3, Insightful)
Learn to spell, get a clue.
There is nothing you can practically do to prevent someone on the internet from sending a packet addressed to you, nor two packets, nor 1000000. There is nothing you can practically do to prevent the source address on each of those packets to be different. If a DOSer has much bigger pipes than you, you are sunk, unless you can do something very smart. For a start, getting remote access to your server during a DOS attack is tricky unless you have re
incompetence effects, not ripple effects (Score:4, Insightful)
In once case, a vital piece of mail sent to a state taxing authority couldn't get through on a month-end calendar deadline, causing much grief.
Maybe a)it shouldn't be left until the deadline and b)sent via email, if it's so damn important.
And maybe you not tell clients to use a free DNS hosting service as their sole DNS provider...
Parent
Re: (Score:2)
Hey! I don't do management consulting for their accounting people. But sometimes this sort of thing tends to have that effect, once the dust settles.
And maybe you not tell clients to use a free DNS hosting service as their sole DNS provider...
Not my call on this one either. Our team is involved on a peripheral project, and this part of their infrastructure was in place long before we got on board. We've
Re:Real ripple effects, even from this small event (Score:2)
Re: (Score:2)
I believe the official policy is that things are supposed to take place by postal mail, and FAX by fallback. But folks at both ends had been swapping mail for months with no problem (and more reliably AFTER the spam filtering went in), and got seduced into assuming it would always work. That's what happens, I see
They deserve the grief (Score:4, Insightful)
Myself, a month ago I missed an opportunity to collaborate on a TV miniseries. Why? Because the moron who asked me for my collaboration absolutely trusted e-mail, and it was **THE** message that bounced thanks to a network glitch, and that moron didn't think of calling me on the **PHONE**. Well, if they were stupid enough to trust e-mail like that, they probably would have made a crappy miniseries anyways.
For casual communications, there is e-mail.
For vital ones, there is registered mail, fax or phone.
Parent
Re: (Score:2)
Yup. But when (in the case I'm citing) an accounting type and a person at a tax office have been happily swapping mail for many months, with little or no lag, they tend to get lulled into a sense of false reliability. And that's what happens.
Re: (Score:3, Insightful)
A lot of mail is misdelivered or just lost. Yet the tax people do not demand that we send in our tax returns by registered mail. And would you be as pissed at the miniseries people if they'd sent you a letter by regular m
"nefarious domain" is a loaded and subjective term (Score:5, Insightful)
to some.. the pirate bay and allofmp3 are "nefarious domains"..
to others "www.f**Ktimewarner.com" and "walmartsucks.com" are "nefarious domains"
and to others "www.wikipedia.org" and "www.aclu.org" are "nefarious domains".
I have a lot of trouble with the idea that DDOS attacks were being carried out in (apparently successful) attempts to wipe domains off the face of the earth..
this implies the attackers had no legal standing to take those domains offline.. then they call them "nefarious" after the fact.
Botnet? Cal it what it is! (Score:4, Insightful)
Where are the class action suits against Microsoft for continually producing such flawed software that makes it easy to 0wn a box?
If it wasn't for 20 some years of MS indifference towards security, there wouldn't be botnets like this, being used for DDOS attacks and forwarding billions of spams a day.
Re: (Score:3, Insightful)
Re: (Score:2)
This of course doesn't help the remote exploits, buffer overflos [in file formats] and other problems that are totally native to MS [and go unfix for random amounts of time]. Not that bugs don't happen in the OSS world, but they tend to be fixed faster, and a larger portion of OSS users are more aware of secure computing practices [e.g. not running as root, not opening every f'i
Re: (Score:3, Insightful)
Open Letter to all Trolls (Score:5, Interesting)
Nothing positive or lasting will come out of trolling (and yes: this means you anonymous asshats on
So why not be part of a winning team and stop script kiddie'ing around from your parents basement.
Sincerely,
The Rest of the Human Race.
Stupid Me... (Score:2)
Every DNS, not EasyDNS. (Score:2)
I have to stress that it is EveryDNS that is under attack, and not EasyDNS.com [easydns.com].
That being said this is not an uncommon issue these days at DNS providers across the 'net. Before anyone starts to kick and scream about how EveryDNS is handling things, remember that these attacks can get astoundingly vicious.
No amount of "clue" or mitigation or whatnot will help when the upstream service providers themselves are having trouble with the traffic load from a large-scale botnet attack.
Re:Every DNS, not EasyDNS. (Score:4, Informative)
Not to mention that networking people generally don't give a shit about bandwidth- it's packets per second that kill routers, not bandwidth. Assuming 100 byte packets that's about 4Mpps- Even a basic 7600 can handle this kind of traffic. Assuming 30 byte packets (can't be smaller than that) you're talking about 15Mpps. Again Even a basic 7600 should be able to handle that- not to mention a Juniper M7i or similar. Most Foundry equipment would laugh at that rate. All of these routers can do ACL's at full packet rates.
That said- other recent DNS attacks exceeded 1.5 Gigabits per second of traffic and were a lot more vicious than the attack being described here.
I'm not knocking EveryDNS- I know what a bitch dealing with a DDoS can be- the problem tends to be that most people aren't ready to deal with it. Using BGP community based nullrouting most service can be restored within seconds of the target IP(s) being identified. That allows admins to keep untargeted systems and services up while the attacked systems are dealt with. The admins can then use the time to locate some/any pattern in the attack or enable the appropriate filtering such as a Cisco Riverguard or similar.
-sirket
Parent
sue (Score:2)
if you have a dog and it bites someone or damages someone's property you are liable, so why not computers?
Re: (Score:2, Insightful)
DNSPark, too (Score:3, Interesting)
Re: (Score:2)
I would hope so. That would be 400/1000 bits of traffic per second. ITYM Megabits.
Re: (Score:2, Informative)
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:3, Insightful)
It's an indirect attack against people who use EveryDNS to get traffic to their own sites (or mail servers, etc). If you ran, say, an online casino, and your main competition for a particular type of customer happened to have EveryDNS doing their forward lookups... and you could shut down your competition for at least a full business day by torpedoing the DNS they need to be seen - presto, done.
Re:solution to DDOS attack (Score:5, Informative)
First off- be prepared for a damned attack and don't wait til it happens. When an attack does come:
1- Identify the target IP address
2- Immediately null-route traffic for that address (preferably using BGP community based null-routing)
This gets the rest of your systems back up and gives you time to work on the problem.
3- Try to identify a pattern in the attacking traffic- use a product from a company like Mazu- or just tcpdump if you're good with sed and awk.
4- If there is a pattern ask the upstream ISP to block based on that pattern (same source port, same source IP, same TTL, whatever). Or block it yourself if you have the router and bandwidth capacity to deal with the attack yourself- though that's generally a waste of your resources.
5- If there is no pattern but the traffic is malformed then enabled a Cisco Riverguard or similar protection device that can filter out malformed traffic at the higher protocol layers. As an alternative, sign up for such a service form a company like Prolexic.
6- Remove your null route and see how you did.
7- If you can't afford a protection service, you can try moving the host/dns records to new IP's. Sometimes the attacks don't follow- sometimes they do. It's often worth a try as it can be done faster than enabling protection services in many cases. In this case leave the old null route in place until the attack stops. Be prepared for the attack to return at any time once they realize what's happened.
Make sure to keep traffic logs for law-enforcement and to share with other ISP's so that they can track down the offending bots.
In the future try to keep your traffic as segregated as possible such that an attack on a single host will not take down too many other services should you need to null-route that address for an extended period of time.
The easiest solution- block all IP addresses assigned to the APNIC region and watch as your site immediately returns to normal. Sadly most of the DDoS's I've seen recently had the majority of their traffic sourced from APNIC addresses.
-sirket
Parent