Slashdot Mirror
DOS Attacks On DNS Provider
Greedo writes "Seems like UltraDNS was hit with a denial of service attack this weekend. Since these are the guys who are supposed to be running the .ORG DNS, and in light of recent attacks on the gTLD roots, attacks against DNS servers should be treated very seriously. What kind of protection can be had? What happens when an attack like this brings down an entire TLD? Do you want to give control of an entire gTLD to one organization? Read a follow-up discussion on comp.protoocols.dns.std."
I mean, isn't that a bit counterproductive?
"Yes, I brought the entire DNS-system crashing down! I'm l337! Now, all I have to do is to go online and brag about my exploits... Hmmm... There seems to be something wrong with my net-connection..."
Lesbian Nazi Hookers Abducted by UFOs and Forced Into Weight Loss Programs - -all next week on Town Talk.
I thought ISOC was about to run the .org TLD in cooperation with afilias? I've never heard about UltraDNS before - do you have any further links about UltraDNS managing .org?
Thank you very much!
Good thing MS is killing DOS in december. It's way
too violent these days.
It's not that big of a deal, since most people's DNS requests never reach the TLD servers. Instead they're handled by a mirror at a lower point on the tree.
But, still, we should catch these DOSers and throw them into a federal pound-me-in-the-ass prison.
Damned arab terrorist scum! Down with Saudi Arabia!!!
Thought you would find this funny:
:)
In IE, I entered ORG and hit enter, just to see what would happen. Although highly unlikely, they could arrange some page there. Instead, MS search brough up a list of possible alternatives. Number one on the list?
Mozilla.org
Thanks, Bill
I was wondering why /. seemed a bit sluggish...
"Some fight for law. Some fight for justice. What will you fight for? One day, you will see."
The ad at the top of the /. homepage was for UltraDNS as I was reading this story. Any publicity is good publicity, I guess...
comrade Taco DOSes your bunghole.
That on my refresh which brought this story up on the home page, the banner directly above it was, for one dollar a month, the world's most reliable dns, ULTRA DNS!!! haha to them.
Guardent is making a lot of noise about this sort of thing. Conspiracy theorists unite!
I want to delete my account but Slashdot doesn't allow it.
I have seen the UltraDNS ads here at Slashdot and thusly decided to read up on their techniques as well.
Basically, they urge large important Web sites to outsource its DNS needs to another company (them). Before this DOS attack on their servers, they provided near perfect stability, security, and performance. If I recall correctly, Hotmail, Forbes, and Oracle have already used the services of UltraDNS.
It's a shame that such a wonderful resource (the Internet) is so often abused by a few rowdy hackers and trolls.
Here is a whitepaper that describes their services in depth and explains the reasons for outsourcing one's DNS needs.
If you celebrate Xmas, befriend me (538
Whereas these attacks, as well as some of the worms that have surfaced recently, strike me more as testing of new techniques and probing of defenses by an organized group that is working on techniques to cause widespread disruption.
sPh
is the following line in my hosts
:)
66.35.250.150 slashdot.org
Then there's ZoneEdit, which is Free-as-in-beer for the first 5 zones. w00t!
I want to delete my account but Slashdot doesn't allow it.
Very stable, performs really, really well on old machines we have here, makes my admin live plenty easy, and never had any security problems with it.
Enough said ;-)
Seems this was as distrubuted DDoS (DDDOS - sounds like a stemmer:-), many people got this..
http://www.merit.edu/mail.archives/nanog/msg053
Since these are the guys who are supposed to be running the .ORG DNS, and in light of recent attacks on the gTLD roots, attacks against DNS servers should be treated very seriously.
Should be? They are. The FBI and the Department of Homeland Security are already investigating this.
I think the orignal concept of the web got lost somewhere. I was under the impression that the Internet itself was designed [by Al Gore :)] to not have a "control center." So that it could function even if most of it was destroyed. But now the internet has been altered into a network that relies on a few DNS servers. Why? So my bookmarks don't have to keep track of IPs? That seems silly. I am also pretty certain that my email address will cease to function without DNS servers as well. So without DNS I can neither access web pages nor email. This is somehow progress?
If you're using an alternative root server.
And in all honesty, I would say that if the "offical" root servers can't protect themselves, they really have no business being root servers (TLD or otherwise) in the first place.
I've been using UltraDNS for more than 2 years now, and I'm also nothing but happy with them.
You're right about their ease of use, it's definitely a strong point.
I've never had any issues with them, and come to think of it, I dodn't have any problems this weekend either. In fact, I got -more- spam than usual, so I'm going to assume that if the spammers didn't have a problem resolving my domain name, neither did anyone else.
"A terrorist is someone who has a bomb but doesn't have an air force." -William Blum
I truly question whether it is realistic to bring the entire system down. There are so many servers around the world that offer a redundant service to those servers that it would be hard to actually "feel" that the root DNS server is no longer available. Which gives whoever quite a bit of time to be able to bring the affected system back up.
How badly can attacking the root DNS servers affect the Internet experience since DNS is so decentralized? If the root server is down, that doesn't prevent the thousands of immediate DNS servers from being able to resolve domain names for the users, right? It seems like it'd only be able to prevent the propogation of new domain names. What gives?
Well at least we can all breathe a sigh of relief when Microsoft retires DOS at the end of the year.
It is more then just a few servers.
Generally each "server" has multiple seperate internet connections. The server it self is usally a set of two or machines acting as one. The servers are distributed around the internet. They are not concentrated in one place eigther geographically, or network topographically.
I use to work for a large internet company in Virginia we use to do these types of things all the time. It is a dirty little secret of the hosting community that large amounts of funds are currently being channeled to companies that suffer attacks large scale attacks to strengthen their infrastructure. I know from personal experince that these government kickbacks are sometimes abused by receiptants.
Not only are the hosting companies after the anti-terror funds. The sysadmin's orchastrate these 'attacks' to gain 'relations' with the investigating FBI Special Agents. If you have not seen the women agents in the FBI's Computer Crimes Division do yourself a huge favor. Most of these 'attacks' orginated from internal addresses and it was typically on one of the sysadmin's birthday treats. I personally of gotten '7-digits' from these agents on numerous occasions and one of these lucky agents will be the mother of my children.
not very nice to post the link to their site. Now not only they had to endure a DDoS ping flood attack, they'll have to deal with the ./ effect!
artaxerxes
You are from Europe aren't you?
Otherwise, you can use everydns.net for free which runs a nice djbdns setup behind a very clean interface and only asks for donations.
DNS is decentralized, in the sense that no server holds all information, but servers only hold information for a certain part of the domain-space. However, *no server can cache all information*, and to answer queries, these servers must ask other servers. And to know which servers are authoritive for a certain domain, you'll have to ask the root servers. This makes DNS pretty centralized in the end. And vulnerable.
RAI-DNS?
Hi Girls!
I'm pleased to anounce that starting from today, you can have sex with me!
That's right!
You can sleep with me, the sex god of the 198th century! It is no longer a dream!
Finally you can have the option of having hot, sweaty and sticky sex with a real man, not those wimpy side-sticking showbots who can tell between a clit and a skin-flap. Finally, you can moan to the night, because you'll have the best treatment. With me.
So don't wait till you die! Dial now and have an hot orgasm.
Look at this, especially that huge packet loss spike at 11/24...
Seems suspicious, although that site hasn't put up any news about it like they did with the major DNS attack a copule of weeks ago.
Beware: In C++, your friends can see your privates!
Reading that Usenet thread was ugly. Dan Bernstein has the unsurpassed ability to present (often) good ideas while being a complete prick.
Dan, you want people to take you more seriously, try being human once in a while. You don't need to prove just how damn intelligent you are by beating other people over the head with their own "ignorance". You might want to work on your own ignorance in the social skills department first.
That said, transmitting the entire root zone over Usenet and other means sounds like a good suggestion. I hope you can start sounding like less of a lunatic so people will listen to the idea.
All ISP's should have access lists on their routers allowing traffic out only if the source address is within their network. Directed Broadcasts should be turned off to limit smurf attacks. This itself would cut the problem ten fold.
While I was reading about DOS attacks and the need for distributed DNS, I never thought I'd come across a post like this.
So it have been DDosed? Let's givem some help /.'ing them too!
Do you want to give control of an entire gTLD to one organization?
Er... wtf do you think is going on right now? It doesn't matter if one organization or ten organizations control a gTLD, a DDOS attack against the root servers is still going to have the same effect. DNS is a creaky old beast that was designed when the internet was a safe (or safer) place... legacy crap that isn't going to go away for a while since -everything- uses it.
For them, the "web" is the "Internet", and anything that affects "the web" could bring down the whole Internet
:-)
Just one thought -- does Freenet use DNS at all? I *think* it doesn't. Because if not, it provides an existing, easy-to-migrate-to solution in case of such a catastrophic event. Just kick over to Freenet, no DNS required.
The DNS system...can withstand a direct nuclear attack on 60% of its facilities
As opposed to, say, those pesky indirect nuclear attacks?
May we never see th
Hammernode is quite good.
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
Given these attacks, maybe it's time to shift the DNS model to something more distributed. Say a P2P network of all the DNS servers, which would feature client side intelligent load balancing (ie it only queries past your ISP's DNS when it needs to). It wouldn't take a whole lot, since it only needs to be capable of a very minute series of transactions. You could throw in CRC codes and a verification system if people wanted to be extra paranoid about it.
Of course, ultimately you have to have some sort of root server. But in a distributed model, they could be essentially insulated from DOS attacks, because they just need to get the master list out to a few systems for it to propagate all over. There could be a redundant distribution mechanism whereby the root servers send the list out through normal channels, but also send it to some randomly selected servers by phone call as a backup. At that stage hosing the root servers (or more accurately their connections, I doubt anyone is gonna ping one of those things to lockup) would not only be difficult and dangerous, but pointless. You cut off its connection via the internet, but the list still gets out and immediately spreads to so many DNS servers you couldn't possibly shut them all down, and you would have to shut down most of the world's DNS servers to have any impact on users.
Ultimately it wouldn't change things too much, since we're already pretty insulated from these attacks. But it does have a nice "just in case" factor to prevent some megaworm or Y2k-style OS-pervasive glitch from knocking us on our butts. And it would take the wind out of the sails for a bunch of the script kiddies (and the odd genuine hacker) out there trying to crash the net, which is almost worht it in and of itself.
Now the skript kiddies are in with the government on the Conspiracy!
May we never see th
Here's a quick overview I found: http://www.pch.net/documents/tutorials/ipv4-anycas t/ipv4-anycast.ppt
Now if we can just get all or most of the root-servers and gtld-servers moved to anycast, then there should be at least minor performance gains, and fairly large stability/resilience-to-DOS gains.
Pound! Bang! Bin! Bash! is this a shell script or a Batman comic?
That's a damn good trick for a Department which has been in existence for 20 minutes, has no headquarters, and largely exists only on paper.
a nd .security/index.html
http://www.cnn.com/2002/ALLPOLITICS/11/25/homel
You must be new here. Welcome to slashdot!
Why not fork?
The problem is not on your end, it's on SecurityFocus's end. I've been having the same problems for a couple of months now, and in spite of assurances from "Dan Bertrand" "Senior IT Manager, Symantec Corporation", it hasn't stopped. He cited either a firewall issue (they don't operate it themselves anymore) or a bandwith issue. I don't buy either of them, I think it's their postfix + DNS setup. Somehow postfix is fed info that your domain does exist, but that there a no valid MX (or A ?) records. If there was a firewall issue, their resolvers should timeout, and their mailsetup should requeue.
--
Ehm... I'm not very creative
This is why lifetime in prison is possible for hackers. Stuff like this can be issues of "national security". If online businses went out for any noticeable amount of time, the U.S. GNP could see a noticable impact.
Blessed be he who reads this post, Cursed be he who tells my boss.
So as the battle weary sys admins from UltraDNS finally get back home from fighting a DDOS attack....
Phone rings.
"Bob, the web server is under attack again, and this one's coming from all around the globe. Game over man, game over."
Slashdot's a bitch.
Hmm... that would certainly explain why I'm not able to find a single damn thing wrong. :) Thanks for that cross-reference data point!
Why would they allow pinging anyways? Really, as a root DNS server, one would think that All they should allow are DNS queries and related. I suppose pinging might suck bandwidth, but just ignoring the pings helps on the server end?
There are some companies developing software, that upon an attack by zombied machines, the server will find the hole, and counter-hack, and completly diable the machine from continuing the DoS attack. Very interesting idea, and finally a way to fight back against the hoards of script-kiddie hackers that are responsible for most DoS attacks.
Yep, the Weekly World News, home of Bat Boy and "Iraqi Submarines Prowling Lake Michigan", has a giant headline in the issue I just saw at the checkout stand: TERRORIST PLOT TO BLOW UP INTERNET ON 1-11!"
The subheads are:
* Computer virus will destroy US economy!
* The US Military will be paralyzed!
* Electricity, food and water supplies vanish!
Clearly, we're ignoring these attacks at our own peril, when as technical a publication as the Weekly World News has picked up the story.
(Back to reality, I literally burst out laughing and almost dropped my Mountain Dew when I saw that headline. Blow up "The Internet". Sounds like my daughter's friends... they come over and ask if her computer "has the Internet on it". No, it doesn't, but it has *access* to the Internet. "Oh, you mean AOL?" Grrr...)
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
Can someone explain exactly what 'the edge' refers to?
And you all thought DOS was dead!
Err.. Oh, heh... Denial of Service.....
*exits quietly*
If the root servers can't protect themselves... who CAN protect themselves?
_________ Help me get a PSP!
The service provides a couple of *supposed* advantages:
> Better latency. They use an anycast routing network which guarantees that a query to their DNS servers will be received and answered by the closest server based on the network topology. Even though there is only 2 published IP's for nameservers. There are some 16 servers scattered around the globe to answer on those IP's.
Yeah, but that's how DNS already works - caching servers choose the DNS server that responds the fastest to DNS requests. Also anycast networks have 1-5 minute delay to fail over to another network in the event of an outage. And there's no failover in the event of a brownout. Since DNS load-balancing operates at the application layer, caching servers can heavily optimize their requests.
> Near real time database updates. They use an Oracle advanced replication network to get updates out to the other servers in near real time.
Nearly all DNS software does this now. See BIND's : ndc reload "zone", and "notify" commands.
> Proprietary software. The only significant advantage here is that it's not BIND.
BIND has been attacked and repaired over and over. It has thousands of eyeballs on it, and hundreds of contributors from major firms. UltraDNS has never been a serious target, like say other big companies with proprietary non-Apache software. Experience shows that proprietary software is significantly less secure than open-source. Wait until some former disgruntled employee publishes the source, and see what happens. Oh wait, you *are* a former employee.
> The problem with your example is that chances are, your DNS server in LA will be getting queries for Europe, which isn't all that ideal. Once again, is it that important? Not really.
Except that right after the DNS gets hit from Europe, the website gets hit from Europe too, and really, there's where you will see issues (if any). As a percentage of time, "DNS hits" consume less than 1% of the time spent on a given web session. If you improve this by 20%, you've sped up your site but less than 1/5th of 1%.
Finally, if you decide to get a "replicated site" in Europe, just put a DNS server there too, and the euro traffic will, likely, hit it first.
Even better, turn off round-robin and zone replication, and have the euro server deliver the euro A-record first (same pattern with the others). Modern browsers will then fail-over in the presence of multiple A-records.
The worst thing about outsourcing, especially DNS, is that you are combining your site with 10,000 other sites on a single network. This creates a more attractive target to hackers.
The best thing about outsourcing is that they "do it for you". Which is really why anyone does it.
yesterday my internet connection kept "dropping" and then coming back. i use cable internet, but it seemed like a DNS problem because i could still ping ip addresses, just not hostnames. i wonder if this was a symptom of the DOS?
I don't know much about the UltraDNS stuff.. as for the other thing:
.com zone file then I suspect a rather large number of users would have had experienced some rather large problems.
7 or the 13 servers went down for a bit. And because of caching and redundancy this wasn't really a notticable thing.
It might be, however if a million windows boxes were comenced such an attack over days.
When it comes right down to it, I think the root operators are doing a pretty good job all things considered. (they're allready approaching ways in which to protect themselves)
However, if this had been an attack on verisign's
Their was a lot of force behind the blow, but the punch wasn't aimed well.
What's bothersome is that if this was used by somone who knew what they were doing. (That's assuming it was an attack and not a warning, or a test of some sort)
That UltraDNS is advertising itself as the most reliable DNS, and yet, it got attacked with a DoS? Reliable indeed....
-illumina+us "I put on my robe and wizard hat..."
Do you want to give control of an entire gTLD to one organization?
Hmm.. trolling for ICANN haters? I see no particular security problem with a central authority managing a TLD, provided that their backup servers are distributed widely in both the geographical and topological senses. We shouldn't confuse this particular issue with that of whether a central authority like ICANN should have the right to control who can and cannot create new TLD's.
So long, and thanks for all the Phish
that a DOS attack was when you went and installed MS-DOS on a computer rendering it inoperable.
"She's a West Texas girl, just like me" - G.W Bush Iraqis
It'd be quite easy to stop all of these ddos attacks....quit linking to other sites from slashdot
"Experience shows that proprietary software is significantly less secure than open-source."
BIND is an exception to this. BIND has an idiotic security record, bloat, and misdesign. Security hole monster. We all know it. Yet you are trying to make believe otherwise.
Actually thats pretty easy, you can turn it off at Turn off the Internet
You're either an engineer or a groupie. If Dan Bernstein's right, it doesn't matter if he's being a prick or a saint.
What in the world makes you think people doing real work need to meet your subjective "social" expectations?
Probabilistic packet marking is an idea to trace packets by coding trace info in unused header bits. Part of the trace info goes in each packet, so one needs many packets to get all the label. The info is placed in a small percentage of packets, so some packets contain info from earlier routers. A victim site will have many packets, so can assemble info for many routers through which the packets passed.
Has this been implemented yet?
Hi People,
I'm probably out of the hot-zone by now since the Backbone-ISP i worked for has gone bankrupt.
This is my experience however.
DDOS attacks cannot be stopped as long as the routers on the backbone are not set-up to do so.
Yeah, you read it right the first time. And we were not the only network to run without any specific setup to dynamically counter attacks.
Sure, there are preferences to configure a router so it can packet-filter and rate-limit DDOS-like traffic (very elaborate ones even) but some ISP rather dont do this since it would fry their precious machinery, and no this is not Microsoft equipement we're talking about here.
Bottom line i got on the root-dns-attack story is that the attackers stopped just-in-time not to choke these servers. Five minutes more and they would have gone belly up. But that might have been a story by itself.
I loaded this page and got a banner for "World's most Reliable DNS - UltraDNS - Bulletproof". Seriously. This is one of the things real editors at real news sources try to avoid :)
It's possible that the weird x.x.0.0 addresses were a programming bug (forgot to run a loop?), but my initial guess was that it was trying to trigger the old-style directed broadcasts (remember when all-zeros was the broadcast instead of all-ones?), guessing that many people have the sense to block all-ones directed broadcast.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Just kick over to Freenet, no DNS required.
;-)
Where am I gonna download a client without DNS?
Comment removed based on user account deletion
Get one of the Freenet guys (or, if an EFF guy is willing to help out again, one of them) to point out that Freenet is the *ideal* protection against terrorist attacks on the information infrastructure of the United States.
Consider all the "security" grants that are being thrown left and right at companies. They're lapping up all those tax dollars in the form of goverment contracts. If Freenet can grab just one, that would fund development for a long, long time. Lots of improvements, and I'd have a hard time imagining a more worthy cause than a more robust, secure, attack-resistant, private system that makes for more efficient transfers over the network.
The overwhelming majority of my university's CS research funding comes from the Department of Defense. Freenet couldn't snag just a few of that flood of dollars going to organizations aroudn the country?
May we never see th
4of12's suggestion would let the rootservers run a server that's only accessible from known (and presumably important) addresses, such as the DNS servers for the big ISPs. That would take care of the most important uses of DNS, since most people get their DNS queries answered by their ISP's servers, either from cache or from recursive queries. Letting the big ISPs do zone transfers from a protected net would preserve that. (Without zone transfers, an obvious attack is for the zombies to look for bogus000001.com, bogus000002.com, etc.)
Beyond that, DNS queries and zone transfers aren't the only way to send the information around. DNS A-record data compresses well (Unfortunately, DNSSEC data doesn't, and it's much bulkier.) And everybody wants the same data, so multicasting can be an efficient way to transmit it (using your favorite reliable-multicast application.) A back-of-the-envelope guess is that the dot-com namespace would compress to somewhere between 100-300MB, which would take 10-30kbps to transmit it in a day - and most of it has a TTL that's much longer, so you could handle it efficiently with incremental updates. Another alternative to multicast would be a peer-to-peer app that's designed for handling big files, like BitTorrent. (BitTorrent's designed more for static content rather than dynamic, so you'd need some file naming scheme for fetching today's version.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
is there any information on whether the DDOS attack on UltraDNS actually affected service?
The UltraDNS infrastructure has 16 or so machines on the same IP number. So it's harder to hit all of them. And it's not BIND, so it may be harder to bring down. (not sure it matters - the root DDOS didn't crash BIND either).
And of course UltraDNS is typically not serving all of the secondaries for a zone.
If anyone has real info....
In the following file you will find listed the IP addresses for all root servers. In case all DNS goes to hell, you can use this to look up any host name, be it COM/NET/ORG, any country, etc.
ftp://rs.internic.net/domain/root.zone.gzWhy kids, why not organized adults with financial resources?
The answer: WHY
Kids.. it's fun, it's destructive, it's a sense of power.. the reasons go on. I shouldn't have to explain them.. go back, I'm sure many of you can understand.
Adults.. and I'm not talking about big kids who never grew up here... need a finanical reason to do this. Could organized, intelligent hackers with financial backing to some serious damange to the internet? You better believe it. What would they have to gain? Not much. Prison. Hatred. Being labeled as terrorists, maybe killed.
What are you going to do? Hold the Interent for ransom? I doubt it.
That's why this stuff is chiefly done by kids, not grownups.
So, ultra DNS gets DoSed, then it get slashdotted too? They're having a great day!
Try actually thinking for yourself. It's quite refreshing.
On the other hand, see what happens if you type in just "CNN".
On IE on my mac, i get cnn.com.
On a Windows 98 computer i tried this on a couple weeks ago, it took me to a "search page" listing a number of sites. The top one, seperated from the others with a big screenshot of the front page and the words "featured link", was MSN.com.
I think CNN was on the list, only further down, but still, what the hell??
> Yeah, Linus is in the US.
...... ;-)
>
> His source trees are in Finland.
OK, someone give him access -fast-
-- babydr@nwrain.net, because of problems with the kernel
- this post brought to you by the Automated Last Post Generator...