Slashdot Log In
DDoS on Domain Registrar
Posted by
ScuttleMonkey
on Mon Mar 27, 2006 07:15 AM
from the paint-by-numbers dept.
from the paint-by-numbers dept.
miller60 writes "Netcraft is reporting that 'domain registrar Joker.com says its nameservers have been hit with a massive DDoS attack, causing outages for customers. More than 550,000 domains are registered with Joker, meaning the outages could be widely felt. It's not clear why the DDoS is succeeding, as most registrars have implemented sturdy DDoS protection since the attack on the root nameserver system back in 2002.' Some security experts have warned in recent weeks about DNS recursion attacks as previously discussed here on Slashdot, which can amplify the power of attacks launched from botnets."
Related Stories
[+]
DDoS Attacks Via DNS Recursion 192 comments
JehCt writes "Associated Press is running a story about how the recursion feature of open DNS servers can be used to launch massive distributed denial of service (DDoS) attacks: 'First detected late last year, the new attacks direct such massive amounts of spurious data against victim computers that even flagship technology companies could not cope.' A thread at WebmasterWorld explains, 'To make a long story short, having a DNS server that allows recursion for the Internet is like running an open SMTP relay.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
This is shame... (Score:1)
(http://www.solarvps.com/)
But why? (Score:5, Interesting)
(http://www.neverwhen.net/)
If anything, I'm surprised that more regitstrars aren't being hit by this. Maybe they agreed to pay up instead.
Not that surprising! (Score:5, Informative)
Can still switch DNS servers (Score:5, Informative)
(http://www.pixelbeat.org/)
one to change the DNS servers away from [abc].ns.joker.com
I did this last for my domain.
Getting sick of this (Score:4, Interesting)
Its going to get worse! (Score:3, Funny)
CoComment down (Score:1, Offtopic)
(http://migs.paraz.com/)
New TLD! (Score:1)
(Last Journal: Monday February 13 2006, @07:11PM)
Hmm, maybe I'm coming too quickly from that other stupidifying discussion.
Resist the urge & take action? (Score:2, Insightful)
(Last Journal: Friday May 21 2004, @07:57PM)
Next up: can everbody who gets hurt by this attack band together and start a class action suit against this ddos'er? Yeah, IF he gets caught...
We're the internet here, and if this hacker gets found, make an example of him.. he should be in deep debt for the rest of his life. THAT'll scare these script idiots...
Crime and Punishment (Score:1)
Why? That's easy ... (Score:2, Interesting)
(http://stupidfundy.blogspot.com/)
Now, I know very well that not everyone registering at joker is carrying on such questionable or downright unscrupulous behavior (certainly less than 1% I hope), but I don't look up the registrar of every domain I visit, just those ones I have a complaint against - which is probably true for most anyone on the net.
The problem is that Joker usually doesn't appear concerned about the activities it's customers engage in (AUP notwithstanding), so it might be that someone out there saw one too many popup or phishing scam coming out of a Joker domain and got no satisfaction at the abuse desk.
Of course this wouldn't be justification for screwing up everyone else's domain, but it's not outside the realm of possibility.
/. effect (Score:2, Funny)
Old news (Score:3, Informative)
(http://www.threesquirrels.com/)
I've used joker.com for years. It's significantly cheaper than Network Solutions and other US registrars and I've never had a problem.
allow-recursion { none; }; doesn't always help. (Score:3, Insightful)
(http://echoreply.us/)
Fortinets, ciscos, Junipers all handle a set number of sessions. Some as low as 1500 - 2000, throw those away when you're talking about a large botnet. Depending on how big the botnet is, and how diverse the attacking blocks are sometimes there is very little to do other than wait it out. Even with higher end Fortinets that support up to 35k sessions, if you have 100k uniques over 30k blocks
DNS records must remain public in order to resolve anything. Sorry folks, but if the network you pissed off is large enough
Some pretty scary chit, especially if you are the one who gets called to deal with it. If you want to yell at someone about it, take your pick from one of the thousands of shared web hosting providers who provide a nice comfy woumb for these networks to grow.
So the next time your host tells you that they've disabled exec(), passthru() and shell_exec() in php for security and restricted access to wget and lynx, go a little easier on them. This is why. They have no control over what their users upload and make available to the world.
Even well hardened servers are easy targets if some jackass uploads phpbb version 1. If any script interpreter can make shell calls, you ought to be checking sockets and connections often.
lsof is your friend, learn how to use it
Tim Berners-Lee said it... (Score:4, Interesting)
(http://aqpeag.blogspot.com/ | Last Journal: Saturday April 21 2007, @05:39AM)
What we need is an entirely peer to peer adaptation of the Web using DHT [wikipedia.org] as an addressing system, where the hash of the file itself serves as its' address. That would solve (at least) two major problems:-
a) It'd get rid of the abovementioned "Internet governance" BS as mentioned above. I believe we could still have an entirely hyperlinked/relational/semantic Web using a DHT system...it just initially might require some more work. The reason why this would eliminate the TLD issue though is because the naming system itself would become irrelevant. It's worth remembering that DNS was originally developed by scientists/academics. If they'd remained the only people using it, it would have worked acceptably. Unfortunately however, the commercialists came along later and fucked it up, which they tend to do to everything they get their hands on. If the commercialists still want the old DNS/TLD system, let them keep it. The DHT system could be implemented for those of us interested in more productive uses of the network.
b) It would at least go a long way towards putting a final nail in the coffin of the {RI,MP}AA's ability to track/identify (and therefore sue) anybody using p2p filesharing. No DNS means no named websites, and no named websites means no centre of gravity/vulnerability to make the {RI,MP}AA's lives easier.
For those of you who think I'm insane, realise that to a degree it's already been done with the Kad p2p network. Anyone connecting to Kad is only able to view (to the untrained or non-mechanical eye, at least) a totally incomprehensible array of numerical strings and file hashes. It might be traceable to individual users, but not easily. What we need to do is figure out how to create an adapted version of HTTP that is able to rely on a machanism similar to Kad as its' trasit/addressing system.
In terms of coding this, I'd have no idea even where to begin myself...so I guess all I can hopefor is that someone else out there who could is sufficiently interested in the idea to try it.
Little biatches, easily squashed (Score:1)
(http://fnarg.com/)
I think we can agree that a self-respecting thief won't build their career around robbing convenience stores for 100$ a pop. If you're going to risk your neck, go for the big payouts. Same thing with online terrorists; make it dangerous enough so the little boys will shy away, and those who are left standing will try to attack the big boys: those who have the resources to fight back. Hell if some chump tried to extort money from me, I'd do all I can to find where he's going to collect the ransom and smack that boy till he cries uncle!
EasyDNS and Prolexic (Score:2)
Prolexic is the brainchild of Barrett Lyon [google.com], who seems to have some experience fighting DDoS attacks. I'd be interested to see how well Prolexic's service actually works, but it seems technically sound to me.
Joker's response (Score:1)
(http://www.sendthemtomir.com/)
Dear Sir/Madam,
thank you for your email.
Unfortunately there is a DDOS Attack on Joker.com Nameservers.
Joker.com currently experiences extremely massive distributed denial of service attacks against
nameservers.
This affects the DNS resolution of Joker.com itself, and also domains which use the Joker.com
nameservers.
We condemn this attack on the sharpest, at the same time our network department works very hard
and does everything in order to achieve a permanent solution.
We are very sorry about this incident and for any inconvenience this may have caused.
Thank you for your understanding and with best regards,
your Joker.com team
Re:Considering... (Score:1)
(http://diddlefinger.com/)
Their business practices? I have used them for many years and never had a problem. It may well be that some "disreputable" websites have registered their domain names with them - but I guess most registrars have their fair share of such registrants. I am not sure how far I want registrars policing the content of websites...
Can you be a little more precise as to the nature of your objection to them?
Re:Considering... (Score:5, Informative)
(http://www.sigsegv.cx/)
On top of that they do not look like they have their own connectivity to peering points in EU.
So frankly, they look like they are ripe for the picking. It is utterly trivial to run a domain registrar out of several diverse locations using RFC 3258. A registrar that is not doing it is in clear need of a cluebat on the head several times. I hope that this DDOS finally delivers it.
Re:Considering... (Score:1)
(http://www.andamooka.com)
Re:Netcraft confirms (Score:1)
who could have perpetrated this criminal caper on such a classic clown? Could this mean the end of our caped crusader? tune in tomorrow.. same bat-time. same bat-website.
I wonder if batman.com is working on an alibi
Re:Considering... (Score:2)
(http://dev.lusis.org/ | Last Journal: Monday December 02 2002, @11:39PM)
What really annoys me is that Joker didn't post anything until two days later. When I COULD get to joker.com, I found nothing at all about the attack. It wasn't until Saturday that I finally got some information. The attack had been going on since Thursday that I know of.
I've had over 20 domains registered with Joker and I've always liked the proccess. Unfortunately, I couldn't afford them to be down.
I'm just curious if the attack was directed at joker or a domain they're the registrar for?
Re:Considering... (Score:1)
Yeah that is what i thought.
A lot of sites experienced outages due to this and caused a problems, considering I run a website for a local real estate company (who does not and never will spam) and a web design firm.
Re:Considering... (Score:2)
(http://phroggy.com/)
And most of the domains that I've seen Joker as a registrar for, including my own, are legitimate sites. They're inexpensive, have good customer service, and don't try to treat their customers like complete morons (Network Solutions used to refer to TLDs as "web extensions" and other such nonsense that actually made it difficult to find what I was looking for on their site).