Massive DDoS Attack Causing Major Problems On The East Coast

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
If you are on the east coast and having trouble reaching major websites like Twitter, Spotify, Imgur, Pinterest, Wired and so on, you're not alone. The good news is that DNS provider Dyn is aware of the problem and actively trying to fix it.

This attack is mainly impacting US East and is impacting Managed DNS customers in this region. Our Engineers are continuing to work on mitigating this issue. Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time. Updates will be posted as information becomes available.

 
Start holding people criminally liable for having compromised computers (criminal negligence). DDoS attacks like this wouldn't be possible if people weren't so negligent in keeping their computers free of malware.

In addition, if it is found out that Russia or China is behind this, their ASN and IP addresses should immediately be revoked by IANA and all traffic should be null routed.
 
Jim Kim said:
When you can put your toilet on the internet, we get what we deserve, big big large huge DDoS attacks.

We Need to Save the Internet from the Internet of Things
Click to expand...

From this article, "the only way for you to update the firmware in your home router is to throw it away and buy a new one." What a complete load of bullshit. He has a fine argument against the Internet of Things that I agree with but ruins his argument with this stinker. Every home router I've seen can have its firmware updated. I don't know where he gets this "fact" but he needs to remove it so that the rest of his point will still stand.
 
EODetroit said:
From this article, "the only way for you to update the firmware in your home router is to throw it away and buy a new one." What a complete load of bullshit. He has a fine argument against the Internet of Things that I agree with but ruins his argument with this stinker. Every home router I've seen can have its firmware updated. I don't know where he gets this "fact" but he needs to remove it so that the rest of his point will still stand.
Click to expand...

if you have the latest firmware on your router and it's eol chances are your options are ddwrt, tomato or throw it away.

and if third parties don't support it guess what.
 
EODetroit said:
From this article, "the only way for you to update the firmware in your home router is to throw it away and buy a new one." What a complete load of bullshit. He has a fine argument against the Internet of Things that I agree with but ruins his argument with this stinker. Every home router I've seen can have its firmware updated. I don't know where he gets this "fact" but he needs to remove it so that the rest of his point will still stand.
Click to expand...

just like android phones, there is no law to guarantee your devices are secure. and just like android phones, the latest firmware for most routers is old and flawed
 
It has been a bummer day for people wanting use PSN, play Battlefield 1, or access Box.com. I am surprised that these big companies don't have backup private DNS servers. That is why Xbox Live and Google are still up on the East Cost.
 
bbs lm-r said:
Mr-Robot-Untapped-Cities-Times-Square-MTA-USA-Sam-Esmail-TV-Film-Locations-NYC.jpg
Click to expand...
 
Darn that Rami Malek dude.... always messing with my Fridays.
 
damicatz said:
Start holding people criminally liable for having compromised computers (criminal negligence). DDoS attacks like this wouldn't be possible if people weren't so negligent in keeping their computers free of malware.

In addition, if it is found out that Russia or China is behind this, their ASN and IP addresses should immediately be revoked by IANA and all traffic should be null routed.
Click to expand...

That would never work unless every single person employed a highly skilled network security team. And even then, sometimes stuff gets through.

If it can be programmed, it can be hacked.
 
Fuck me , finally kids are asleep and i`m sitting down for my first proper BF1 session since the launch of the game, and cant go online
 
Haven't been able to reach community.spiceworks.com at all since about 10 am.
 
EODetroit said:
From this article, "the only way for you to update the firmware in your home router is to throw it away and buy a new one." What a complete load of bullshit. He has a fine argument against the Internet of Things that I agree with but ruins his argument with this stinker. Every home router I've seen can have its firmware updated. I don't know where he gets this "fact" but he needs to remove it so that the rest of his point will still stand.
Click to expand...

You're right his points are still valid, even if a single statement is wrong. Don't throw the baby out with the bath water.
 
Jim Kim said:
You're right his points are still valid, even if a single statement is wrong. Don't throw the baby out with the bath water.
Click to expand...


It damages the credibility of the writer. When you see an obviously inaccurate statement then you challenge the validity of the entire piece, it all has to stand on it's own or it isn't trustworthy.

I just checked and it looks like PayPal is back up, but I am not going to even try and sign in so soon. How would I know if the site has been compromised? Any site that you do business with and was down may not come back as secure, I'd give them a couple of days to make sure they are in good shape before I started posting transactions on a site effected by this attack.
 
cyclone3d said:
That would never work unless every single person employed a highly skilled network security team. And even then, sometimes stuff gets through.

If it can be programmed, it can be hacked.
Click to expand...

You don't need a team. Just a computer person who knows how to do basic security.

People hire mechanics to maintain their cars. If a person doesn't maintain their car, and someone gets hurt (e.g. steering wheel falls off or brakes fail due to negligent maintenance) they are held liable. I see no reason why the same shouldn't be true for computers; if you are negligent in your security, you should be held liable for the damages. If you don't know how to secure your computer, there are plenty of computer shops that can help with that.
 
damicatz said:
You don't need a team. Just a computer person who knows how to do basic security.

People hire mechanics to maintain their cars. If a person doesn't maintain their car, and someone gets hurt (e.g. steering wheel falls off or brakes fail due to negligent maintenance) they are held liable. I see no reason why the same shouldn't be true for computers; if you are negligent in your security, you should be held liable for the damages. If you don't know how to secure your computer, there are plenty of computer shops that can help with that.
Click to expand...

What do you consider basic security?

The reason I ask is a small business is one thing, but any business that maintains their own Enterprise environment has many many more moving parts, the network, storage, servers, web services, AD, DNS, the list can be extensive. And that will require a team or a very experienced security guy that actually knows all of those elements well enough to determine the current security posture and effectively improve it.

Of course, even the most complete and effective security posture can be rendered ineffective by a single idiot. We have one here where I work and he is an outstanding example of the breed. This guy was making regular backups of VMs by creating OVFs and saving them to a external USB 2.0 drive. When I found out I was a little surprised, I have multiple storage systems on 10G ether connections that he could copy those files to much faster than 800mbps. He was sitting at his desk watching the progress bar when I came by to offer him options.

He said "That's OK, this is what they pay me to do."

When Trump is elected this guy should be the first one fired.
 
lcpiper said:
What do you consider basic security?

The reason I ask is a small business is one thing, but any business that maintains their own Enterprise environment has many many more moving parts, the network, storage, servers, web services, AD, DNS, the list can be extensive. And that will require a team or a very experienced security guy that actually knows all of those elements well enough to determine the current security posture and effectively improve it.

Of course, even the most complete and effective security posture can be rendered ineffective by a single idiot. We have one here where I work and he is an outstanding example of the breed. This guy was making regular backups of VMs by creating OVFs and saving them to a external USB 2.0 drive. When I found out I was a little surprised, I have multiple storage systems on 10G ether connections that he could copy those files to much faster than 800mbps. He was sitting at his desk watching the progress bar when I came by to offer him options.

He said "That's OK, this is what they pay me to do."

When Trump is elected this guy should be the first one fired.
Click to expand...

Basic security such as not using the default passwords and not exposing devices to the internet without a firewall. Using anti-virus software. Not downloading random exes from the internet.

The DDoS attacks are only possible because so many idiots put things on the internet without knowing how to secure them.
 
Jim Kim said:
Favorite post

"DDoS attack this morning takes out Reddit, Twitter & Spotify. Work productivity increases by 300%"
Click to expand...
Actually it would be down to 30%. Because people would be just pissed off, trying to reload the pages every 2 seconds, and asking the guy in the next cubicle if they got it working yet.
 
And I thought it was just me. I even went to the downforeveryoneorjustme.com site to check and that said it was just me.. I was going to reboot my PC at the end of the day to see if that fixed the dns issue..
 
So annoying, I can't even imagine how much money some of these sites lost. For us, we are hours behind now pricing components, and calling in is really not an option with how big our BOM's are. Damn kids!
 
lcpiper said:
What do you consider basic security?

The reason I ask is a small business is one thing, but any business that maintains their own Enterprise environment has many many more moving parts, the network, storage, servers, web services, AD, DNS, the list can be extensive. And that will require a team or a very experienced security guy that actually knows all of those elements well enough to determine the current security posture and effectively improve it.

Of course, even the most complete and effective security posture can be rendered ineffective by a single idiot. We have one here where I work and he is an outstanding example of the breed. This guy was making regular backups of VMs by creating OVFs and saving them to a external USB 2.0 drive. When I found out I was a little surprised, I have multiple storage systems on 10G ether connections that he could copy those files to much faster than 800mbps. He was sitting at his desk watching the progress bar when I came by to offer him options.

He said "That's OK, this is what they pay me to do."

When Trump is elected this guy should be the first one fired.
Click to expand...

Love it!

And yes, one idiot can bring down the whole system, unfortunately here we have MANY idiots...so it's a constant battle.
 
lcpiper said:
It damages the credibility of the writer. When you see an obviously inaccurate statement then you challenge the validity of the entire piece, it all has to stand on it's own or it isn't trustworthy.
Click to expand...
Don't be pedantic.
Sure, the guy said the only way to update home routers was to throw them away, but we know that there are millions of home routers in the wild that cannot be updated.
Whether it's because A.the manufacturer has no current firmware available, product is elo, B.the user does not know how to update the firmware, C.no open source firmware is available (majority would not even know tomato or dd-wrt from a potato).
One inaccurate sentence does not invalidate the other points.
 
lcpiper said:
I just checked and it looks like PayPal is back up, but I am not going to even try and sign in so soon. How would I know if the site has been compromised? Any site that you do business with and was down may not come back as secure, I'd give them a couple of days to make sure they are in good shape before I started posting transactions on a site effected by this attack.
Click to expand...

As long as you are connecting to an https site, and you have a green bar or green lock, you should be fine. That is the entire point of the public certs.
 
LeftSide said:
As long as you are connecting to an https site, and you have a green bar or green lock, you should be fine. That is the entire point of the public certs.
Click to expand...

Never mind the fact that this attack was against the DNS infrastructure and not the websites themselves.
 
Dang, all these internet sites down, I guess we'll have to go out into the real world :nailbiting:
 
You must log in or register to reply here.
Back
Top