Slashdot Mirror
DOS Attacks On DNS Provider
Greedo writes "Seems like UltraDNS was hit with a denial of service attack this weekend. Since these are the guys who are supposed to be running the .ORG DNS, and in light of recent attacks on the gTLD roots, attacks against DNS servers should be treated very seriously. What kind of protection can be had? What happens when an attack like this brings down an entire TLD? Do you want to give control of an entire gTLD to one organization? Read a follow-up discussion on comp.protoocols.dns.std."
At subway, you get a sub prepared anyway you like, by the friendly, efficient staff. Choose from mouth-watering veggies, succulent meats and cheeses, and a variety of freshly-baked bread. Why not stop in today and pick up some subs for the whole family to enjoy. I suggest the Italian BMT, piled high with genoa salami, pepperoni, ham, and provolone cheese. Top it with lettuce, tomato, onion, and pickles, add a few spritzes of italian dressing and you've got a meal fit for king. Subway: eat fresh!
g to the oatse
c to the izzex
fo shizzle my nizzle click here (note: the site is currently down. I expect it to come back online around Thanksgiving) to dispatch Jared and his formerly overweight goons to crack down on Subway if they don't honor the $3.49 Troll Tuesday deal. Make sure you provide the store number and address. Mine is store number 5839. Don't believe me about the concept of the jared dispatch? Yahoo has an article about it here, although it is pretty light on the details.
Note: I've gotten a few comments that the link to Jared Dispatch doesn't work. I think the site got taken down because of abuse of the service. Although the site got taken down, I still highly reccomend Subway and their high quality subs. To show my appreciation, here is a link to Free Subway Coupons. I had to redirect it through Yahoo's site redirector, because my of the filter at work. Anyways, here is the link!
Note 2: I've received word that those links to yahoo actually point to goatse.cx. I am truly sorry about that, and I found the cause. A couple weeks ago, a hacker broke into yahoo and set up some scripts that redirect the user to goatse.cx if a file is in a certain directory. I accidentally tried to access a file in one of those haunted directories. I fixed the links (I have a cousin who works at yahoo), so they should bring you to the actual sites now, not goatse.cx. Update 10/28: The hacker, or should I say hax0r, actually has posted a page on yahoo on how he did it and how the goatse redirector works. It's a very good read. I suggest reading it soon before yahoo finds out about it and takes it down. Check it out ASAP!
Note 3: I am working on locating the articles using google's cache. It is taking some time because I don't remember the exact titles. However, I hope to have the links fixed and working very soon. Keep eating at Subway in the meantime, and request that they bring back the jalepeno cheese roll. It is a fanscrumptiously brilliant roll.
Note 4: To all those who think that sub is an incorrect term, I live in upstate NY, and we call it a sub here. There are no hoagies, grinders, po'boys, footlongs, heroes, or any other made up names. It's not hoagieway after all, its Subway.
Important: It is my duty to report to you, loyal low-threshold readers, of a very disturbing incident that happened to me last week. I went into subway at the normal lunch time, but instead of the standard line out the door, the restaurant was vacant. Normally, the queue doesn't concern me, since the crew knows enough to make me a footlong Italian BMT with my standard fixin's and have it ready at 11:30 sharp, on tuesdays. I approached the counter casually, when two bulky men appeared from each side of the potato chip display rack. They held me down, and Jared appeared from behind the counter. He took my preprepared footlong BMT and cracked an evil grin. The manager grabbed the bottle of italian dressing and lubed up my general ass area. Jared shoved the footlong Italian BMT repeatedly into my ass, mixing it with the chucks of feces that were in my bowels, until the fresh crisp veggies resembled brown spoiled food. I begged him to stop, but little did I know the torture waiting for me. He took the italian dressing, and squirted it into my pee hole. Now, it burns when I pee, and it hurts when I sit. I asked him why he was doing this, and he said that they had tracked me down for my abuse of the Jared Dispatch system. You see, Jared gets airsick, and his constant flying over the country has caused him to lose weight due to his vomiting on planes. Normally, this loss of weight would be a good thing, but Subway can't actually claim that he lost weight by eating Subway subs. They told him to put the weight back on and then lose it again by eating subs, somthing Jared does not want to do. As a result, they are the ones who closed down Jared Dispatch. I am begging you, loyal readers DON'T GO TO JARED DISPATCH ANY MORE. Thank you for your time. I have to go to Subway now, and tell them that I want less italian dressing on my footlong Italian BMT. Remember, if you don't eat at subway, then the terrorists win! (note: On the link above, I used client-side redirection. Therefore, if it sends you to goatse.cx, it is a problem with YOUR COMPUTER, NOT THE WEB PAGE!)
We have MS-DOS attacks on DNS providers.
I mean, isn't that a bit counterproductive?
"Yes, I brought the entire DNS-system crashing down! I'm l337! Now, all I have to do is to go online and brag about my exploits... Hmmm... There seems to be something wrong with my net-connection..."
Lesbian Nazi Hookers Abducted by UFOs and Forced Into Weight Loss Programs - -all next week on Town Talk.
I thought ISOC was about to run the .org TLD in cooperation with afilias? I've never heard about UltraDNS before - do you have any further links about UltraDNS managing .org?
Thank you very much!
any time you run Dos on a DNS server you should expect to get attacked....
"The two most abundant elements in the universe are hydrogen and stupidity." -Harlan Ellison
those responsible should be tried in military court, convicted and shot, and the whole thing should be shown on Fox's "When geeks attack".
Good thing MS is killing DOS in december. It's way
too violent these days.
It's not that big of a deal, since most people's DNS requests never reach the TLD servers. Instead they're handled by a mirror at a lower point on the tree.
But, still, we should catch these DOSers and throw them into a federal pound-me-in-the-ass prison.
Damned arab terrorist scum! Down with Saudi Arabia!!!
Thought you would find this funny:
:)
In IE, I entered ORG and hit enter, just to see what would happen. Although highly unlikely, they could arrange some page there. Instead, MS search brough up a list of possible alternatives. Number one on the list?
Mozilla.org
Thanks, Bill
I was wondering why /. seemed a bit sluggish...
"Some fight for law. Some fight for justice. What will you fight for? One day, you will see."
The ad at the top of the /. homepage was for UltraDNS as I was reading this story. Any publicity is good publicity, I guess...
comrade Taco DOSes your bunghole.
That on my refresh which brought this story up on the home page, the banner directly above it was, for one dollar a month, the world's most reliable dns, ULTRA DNS!!! haha to them.
It was over the weekend, right? Maybe people were just home from work and wanted to do a little surfing. Since most people don't use their home PCs much, I bet all the domain names had TTL'd out and needed to be refreshed. Maybe this "UltraDNS" place is less ultra than their name suggests. A lot of companies nowadays are trying to make their underpowered server rooms sound like DoS situations to get hold of anti-terrorism funds.
It's official. Microsoft now confirms. DOS is dying.
Popularized in the 80's beyond academic circles due to the exploding popularity of the IBM PC's and the ability to make cheap, compatible hardware, MS-DOS has lost marketshare steadily throughout the decade of the 90's.
Since the release of Windows '95, more and more powerful computers have been required to run the "latest and greatest software," and as a result, older computers often get tucked away in the attic with old Apple IIe machines.
You don't need to be Kreskin to predict DOS' future. The hand writing is on the wall: DOS faces a bleak future. In fact there won't be any future at all for DOS because DOS is dying. Things are looking very bad for DOS. As many of us are already aware, DOS continues to lose market share. Red ink flows like a river of blood.
Let's keep to the facts and look at the numbers.
MS-DOS leader Ballmer states that there are 7000 users of MS-DOS. How many users of PC-DOS are there? Let's see. The number of MS-DOS versus PC-DOS posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 PC-DOS users. DR-DOS posts on Usenet are about half of the volume of PC-DOS posts. Therefore there are about 700 users of DR-DOS. A recent article put Windows 3.1 at about 80 percent of the DOS market. Therefore there are (7000+1400+700)*4 = 36400 Windows 3.1 users. This is consistent with the number of Windows 3.1 Usenet posts.
All major surveys show that DOS has steadily declined in market share. DOS is very sick and its long term survival prospects are very dim. If DOS is to survive at all it will be among OS hobbyists, dabblers, and dilettantes. DOS continues to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, DOS is dead.
It's time we accepted this simple fact: DOS is DYING.
Guardent is making a lot of noise about this sort of thing. Conspiracy theorists unite!
I want to delete my account but Slashdot doesn't allow it.
I have seen the UltraDNS ads here at Slashdot and thusly decided to read up on their techniques as well.
Basically, they urge large important Web sites to outsource its DNS needs to another company (them). Before this DOS attack on their servers, they provided near perfect stability, security, and performance. If I recall correctly, Hotmail, Forbes, and Oracle have already used the services of UltraDNS.
It's a shame that such a wonderful resource (the Internet) is so often abused by a few rowdy hackers and trolls.
Here is a whitepaper that describes their services in depth and explains the reasons for outsourcing one's DNS needs.
If you celebrate Xmas, befriend me (538
I've been using UltraDNS for over a year now. I had to commit to a year at $5/mo, I figured $60 was worth it, since it'd be awhile before I got BIND set up and running.
WOW. It's so simple to use, updates are instantaneous, it's like running your own DNS server without all the config files. The web interface makes it a breeze to change things around, add domains, records etc. And all for FIVE DOLLARS A MONTH!!!
I'm close to getting my own DNS running, but in the interim the service has been more than worth it. If you've ever wanted the power of your own DNS server without the headaches, this is it.
There is no reasonable defense against an idiot with an agenda
:wq
CmdrTaco TacoSnotted me!
:) Join me in a WIPO-snot?
Why do I keep receiving emails from an individual calling himself CmdrTaco?
You have been receiving unsolicited mailings from a certain Robert CmdrTaco Malda, owner of the popular technology website slashdot.org. Actually, its not a very popular site in the common sense of the word; the site is rife with pimply, antisocial geeks and hackers, zit-faced nerds, communists, dirty GNU hippies, and other societal rejects and outcasts. Its also home to one of the worlds largest suspected pdophile rings, the infamous Slashdot crew.
Whenever Mr. Malda gets bored (and who wouldnt, running a site like Slashdot all day), he roams through the user database, penis in hand, looking for people who might enjoy engaging in homosexual activities with him. How he determines this is anyones guess; but if you have a homosexual-sounding nickname, or a nick with a letter of the English alphabet in it, youre a potential candidate.
This time, he found you. Lucky you.
Mr. Malda seems to be speaking in some sort of code. Do you know what it means?
CmdrTacos code language is relatively easy to decipher. This pervert prefers to speak in thinly-veiled sexual innuendo (yes, thats right: he wants you) to evade the watchful eye of Slashdots parent corporation, VA Software. Mr. Maldas Commander is, of course, his penis: a small, withered little thing that lives in his pants and only comes out in the presence of other male geeks or at the beck and call of Maldas own lubed-up right hand. His Taco bells are the shriveled testicles that droop beneath his Commander, and his Taco sauce is his thin, runny semen. It should be more than obvious to you now what he means if he asked you to ring his Taco bells or taste his gourmet Taco sauce.
I would also guess CmdrTaco asked you to engage in a practice known as Taco-snotting and, if he was in a particularly depraved mood at the time, a circle-snot.
Good Lord. And, yes, he did. What is Taco-snotting?
Taco-snotting is the term used by Robert Malda to refer to the depraved act of fellating another man (homo- or heterosexual; CmdrTaco is rumoured to prefer raping unwilling victims), then blowing the semen out his nose and back onto the face and body of his victim. Naturally, a long, bubbly stream of milky-white semen is left on CmdrTacos face, dribbling out of his nose and down his cheek: hence the term, Taco-snotting.
And if thats not bad enough
A circle-snot is a Taco-snotting circle-jerk, another practice common among the Slashdot crew. CmdrTaco, CowboiKneel, and Homos get together and snot each other with their gooey, sticky cum spooging their jizz-snot all over each others faces and pasty, white bodies, until theyre covered head to toe with their own and each others man juice. This vile, ungodly ritual can go on for hours. For the homosexual penetration that follows this lengthy foreplay, Roblowme is usually there to provide plenty of anal lubricant; he owns a limousine service and has ample supplies of motor oil and axle grease ready to go.
To complete this perverted orgy, fellow faggots Michael, Timothy, and Jamie will usually join in, dressed in tight leather mock-S.S. uniforms, jack boots, and leather gloves. The homosexual shenanigans that follow are nearly beyond description. The whole group begins to snot each others spunk and whip each others pudgy asses with riding crops and chains until their pale, white geek bodies are exhausted and soaked in stinking sweat from the hours of passionate, homosexual revelry.
Ewwwwww. So, can I stop receiving these emails?
Hopefully, but I wouldnt count on it.
To begin with, you most likely forgot to uncheck the Willing to Snot checkbox in your account preferences. CmdrTaco has probably already got the hots for your wad (do you have a homosexual-sounding nick?), and hes probably already been lurking outside your bathroom window for weeks with a camera, some tissues and lube, just waiting to pounce and declare you his new bitch. Theres no escaping a geek in heat (trust me), so its probably too late for you, but you can possibly rectify this situation. To remove yourself from CmdrTacos sights, log into your Slashdot account, go to your user page, click on Messages, and uncheck the box next to Willing to Snot. Maybe hell ignore you. Probably not.
I cant stop receiving these emails from CmdrTaco!?
If you indulge him in a Taco-snot or two, he might leave you alone. You might also want to look into mail filtering, restraining orders, or purchasing a heavy, blunt object capable of warding off rampaging homosexual geeks in heat. Trust me, when they charge oh, the humanity. If he gets you, and you let him Taco-snot all over you, you will most likely end up tied up in his basement to be used as his sex slave for the rest of your life (or until he accidentally drowns you in spunk in a circle-snot).
Have you ever been Taco-snotted?
Unfortunately, yes. I first met Mr. Malda at an Open Source Convention. He invited me back to his room for a game of Quake and some gourmet Tacos, but when I got there, the perverted geek jumped me and handcuffed me to his bed, stripping me. After taking his Commander out of his pants, Mr. Taco made me suck the withered thing six times, virtually nonstop. He then performed his vile Taco-snotting ritual on me three times over the next two hours, bringing me to orgasm after orgasm after sweaty, mind-numbing orgasm then he snotted my own thick, gooey jizz back onto my face out of his nostrils! He snotted me two more times, first into my mouth, then again on my exposed belly.
CmdrTaco invited several of his Open Source (or rather, Open Sauce man sauce) buddies over to continue their ungodly snotfest. European hacker and known berfaggot Linux Torvalds raped my ass with his monolithic kernel; his partner-in-crime Anal Cox used their network stack in a multitude of unspeakable ways on and in every orifice of my defenseless, tender, young body. Michael Sims was there in his leather Nazi uniform, caning my previously-virginal ass with a bamboo pole and ranting about all those Censorware freaks out to get him.
That is so disgusting! How did you finally escape?
After about 16 hours of countless unholy, homosexual atrocities perpetrated against my restrained body, they all finally went to sleep on top of me, sweat-soaked and exhausted. I was left there, completely covered in bubbly, translucent jizz-snot, chained to the bed, with half a dozen fat, pasty-white fags lying around and on top of me. Fortunately the spooge coating my flesh worked wonderfully as a lubricant I was able to squirm my way out of the handcuffs and slip out the back door (of the apartment, not their back doors). Im just glad I survived the awful ordeal. These sexually-repressed hackers had a lot of built-up spunk in their wads I couldve easily been drowned!
Thats horrible. Does Taco-snotting have anything to do with CmdrTacos special taco?
No, thats a different disgusting perversion CmdrTaco indulges himself in. Mr. Malda is usually not satisfied with merely snotting your own jizz back onto your face, he most often enjoys involving his own bodily fluids in his twisted games. WeatherTroll has spent some time trying to educate the Slashdot readership about this vile practice (emphasis added):
You may be wondering what CmdrTacos special taco is. You will be wishing that you hadnt been wondering after you finish reading this post. To make his special taco, CmdrTaco takes a taco shell and shits on it. He then adds lettuce, takes out his tiny withered dick (otherwise known as his Commander), puts his special taco sauce on it which means he jacks off on the taco, and adds a compound to make the person who eats the taco unconscious. Of course, the compound does not make the person unconscious until the taco is fully eaten. Thus CmdrTaco force-feeds the taco to the unsuspecting victim. After all, who would knowingly eat shit and CmdrTacos jizz?
After the victim is unconscious, he is held against his will and used for CmdrTacos nefarious homosexual purposes. This includes shoving taco shells up the victims ass, Taco-snotting, and getting Jon Katz involved. Trust me, you do not want Jon Katz anywhere near your unconscious body. Also, rumor has it CmdrTaco is looking for a new goatse.cx guy. Dont let it be you!
Different ungodly perversion, yet no less revolting. It should be clear to you now that Robert CmdrTaco Malda is a very, very sick individual, as are most of the Slashdot editors.
Does Jon Katz get involved in any of this? I thought he was a pdophile, not a homosexual.
Actually, Jon Katz is a homosexual pdophile. Hes also a coprophiliac, and, many suspect, a zoophile.
Mr. Katz is somewhat of a loner and doesnt involve himself in the circle-snots, but that doest mean hes any less of a freak than the rest of the Slashdot crew. Katz often engages in a game called juicy-douching with a harem of little-boy slaves that he has collected over the years: yet another vile practice which involves administering an enema to himself of the little boys urine (forced out of them with a pair of pincers), spooging the vile muck from his ass back into the enema bag, then dribbling and slathering the goo all over himself and the boys chained, naked bodies. If hes in the mood, he will sometimes skip refilling the enema bag from his distended anus and just squirt it from his ass onto the crying, terrified boys. Unwilling boys are further tortured with the pincers until they comply and allow Mr. Katz to juicy-douche them at will. A boy will usually last about two years before Mr. Katz either accidentally drowns them in diarrhea or kills them once they get too old, usually around 13 or 14.
Not content with being a pdophilic coprophile, Mr. Katz is also quite the zoophile. As if the sexual escapades with the helpless little boys arent enough, Jon usually enjoys his juicy-douches best when his penis is firmly planted in a female goats anus. He is also rumoured to get off on watching his little boys eat the goats small, bean-like turds, and he often kills his older boys by letting his goats trample them.
Are you getting hard writing this?
Why, yes.
No, thanks. Im already CmdrTacos boi toi.
Whereas these attacks, as well as some of the worms that have surfaced recently, strike me more as testing of new techniques and probing of defenses by an organized group that is working on techniques to cause widespread disruption.
sPh
is the following line in my hosts
:)
66.35.250.150 slashdot.org
Is more bandwidth... Yup.
Very stable, performs really, really well on old machines we have here, makes my admin live plenty easy, and never had any security problems with it.
Enough said ;-)
Seems this was as distrubuted DDoS (DDDOS - sounds like a stemmer:-), many people got this..
http://www.merit.edu/mail.archives/nanog/msg053
http://jaguars.jacksonville.com/special/mondaymorn ingqb/
Show these people how Real Trolling(TM) works!!
Take a look! Amazon.com is DOWN!
(and stephen King is dead today, at the age of 55, killed by a DoS attack.
Since these are the guys who are supposed to be running the .ORG DNS, and in light of recent attacks on the gTLD roots, attacks against DNS servers should be treated very seriously.
Should be? They are. The FBI and the Department of Homeland Security are already investigating this.
I think the orignal concept of the web got lost somewhere. I was under the impression that the Internet itself was designed [by Al Gore :)] to not have a "control center." So that it could function even if most of it was destroyed. But now the internet has been altered into a network that relies on a few DNS servers. Why? So my bookmarks don't have to keep track of IPs? That seems silly. I am also pretty certain that my email address will cease to function without DNS servers as well. So without DNS I can neither access web pages nor email. This is somehow progress?
If you're using an alternative root server.
And in all honesty, I would say that if the "offical" root servers can't protect themselves, they really have no business being root servers (TLD or otherwise) in the first place.
I truly question whether it is realistic to bring the entire system down. There are so many servers around the world that offer a redundant service to those servers that it would be hard to actually "feel" that the root DNS server is no longer available. Which gives whoever quite a bit of time to be able to bring the affected system back up.
How badly can attacking the root DNS servers affect the Internet experience since DNS is so decentralized? If the root server is down, that doesn't prevent the thousands of immediate DNS servers from being able to resolve domain names for the users, right? It seems like it'd only be able to prevent the propogation of new domain names. What gives?
Well at least we can all breathe a sigh of relief when Microsoft retires DOS at the end of the year.
It is more then just a few servers.
Generally each "server" has multiple seperate internet connections. The server it self is usally a set of two or machines acting as one. The servers are distributed around the internet. They are not concentrated in one place eigther geographically, or network topographically.
not very nice to post the link to their site. Now not only they had to endure a DDoS ping flood attack, they'll have to deal with the ./ effect!
artaxerxes
Otherwise, you can use everydns.net for free which runs a nice djbdns setup behind a very clean interface and only asks for donations.
Take a look for yourself! DEAD DEAD DEAD
DNS is decentralized, in the sense that no server holds all information, but servers only hold information for a certain part of the domain-space. However, *no server can cache all information*, and to answer queries, these servers must ask other servers. And to know which servers are authoritive for a certain domain, you'll have to ask the root servers. This makes DNS pretty centralized in the end. And vulnerable.
RAI-DNS?
Hi Girls!
I'm pleased to anounce that starting from today, you can have sex with me!
That's right!
You can sleep with me, the sex god of the 198th century! It is no longer a dream!
Finally you can have the option of having hot, sweaty and sticky sex with a real man, not those wimpy side-sticking showbots who can tell between a clit and a skin-flap. Finally, you can moan to the night, because you'll have the best treatment. With me.
So don't wait till you die! Dial now and have an hot orgasm.
Look at this, especially that huge packet loss spike at 11/24...
Seems suspicious, although that site hasn't put up any news about it like they did with the major DNS attack a copule of weeks ago.
Beware: In C++, your friends can see your privates!
Reading that Usenet thread was ugly. Dan Bernstein has the unsurpassed ability to present (often) good ideas while being a complete prick.
Dan, you want people to take you more seriously, try being human once in a while. You don't need to prove just how damn intelligent you are by beating other people over the head with their own "ignorance". You might want to work on your own ignorance in the social skills department first.
That said, transmitting the entire root zone over Usenet and other means sounds like a good suggestion. I hope you can start sounding like less of a lunatic so people will listen to the idea.
Behind my router, my computer is called 'whitebox'. Its ip adress is 192.168.2.7.
Nero-burning ROM for Linux!
All ISP's should have access lists on their routers allowing traffic out only if the source address is within their network. Directed Broadcasts should be turned off to limit smurf attacks. This itself would cut the problem ten fold.
While I was reading about DOS attacks and the need for distributed DNS, I never thought I'd come across a post like this.
So it have been DDosed? Let's givem some help /.'ing them too!
Do you want to give control of an entire gTLD to one organization?
Er... wtf do you think is going on right now? It doesn't matter if one organization or ten organizations control a gTLD, a DDOS attack against the root servers is still going to have the same effect. DNS is a creaky old beast that was designed when the internet was a safe (or safer) place... legacy crap that isn't going to go away for a while since -everything- uses it.
For them, the "web" is the "Internet", and anything that affects "the web" could bring down the whole Internet
:-)
Just one thought -- does Freenet use DNS at all? I *think* it doesn't. Because if not, it provides an existing, easy-to-migrate-to solution in case of such a catastrophic event. Just kick over to Freenet, no DNS required.
The DNS system...can withstand a direct nuclear attack on 60% of its facilities
As opposed to, say, those pesky indirect nuclear attacks?
May we never see th
Hammernode is quite good.
"The lesson to be learned is not to take the comments on slashdot too literally." --Vinnie Falco, BearShare
Given these attacks, maybe it's time to shift the DNS model to something more distributed. Say a P2P network of all the DNS servers, which would feature client side intelligent load balancing (ie it only queries past your ISP's DNS when it needs to). It wouldn't take a whole lot, since it only needs to be capable of a very minute series of transactions. You could throw in CRC codes and a verification system if people wanted to be extra paranoid about it.
Of course, ultimately you have to have some sort of root server. But in a distributed model, they could be essentially insulated from DOS attacks, because they just need to get the master list out to a few systems for it to propagate all over. There could be a redundant distribution mechanism whereby the root servers send the list out through normal channels, but also send it to some randomly selected servers by phone call as a backup. At that stage hosing the root servers (or more accurately their connections, I doubt anyone is gonna ping one of those things to lockup) would not only be difficult and dangerous, but pointless. You cut off its connection via the internet, but the list still gets out and immediately spreads to so many DNS servers you couldn't possibly shut them all down, and you would have to shut down most of the world's DNS servers to have any impact on users.
Ultimately it wouldn't change things too much, since we're already pretty insulated from these attacks. But it does have a nice "just in case" factor to prevent some megaworm or Y2k-style OS-pervasive glitch from knocking us on our butts. And it would take the wind out of the sails for a bunch of the script kiddies (and the odd genuine hacker) out there trying to crash the net, which is almost worht it in and of itself.
Now the skript kiddies are in with the government on the Conspiracy!
May we never see th
Here's a quick overview I found: http://www.pch.net/documents/tutorials/ipv4-anycas t/ipv4-anycast.ppt
Now if we can just get all or most of the root-servers and gtld-servers moved to anycast, then there should be at least minor performance gains, and fairly large stability/resilience-to-DOS gains.
Pound! Bang! Bin! Bash! is this a shell script or a Batman comic?
That's a damn good trick for a Department which has been in existence for 20 minutes, has no headquarters, and largely exists only on paper.
a nd .security/index.html
http://www.cnn.com/2002/ALLPOLITICS/11/25/homel
Try +1 Funny for the parent.
You must be new here. Welcome to slashdot!
Why not fork?
The problem is not on your end, it's on SecurityFocus's end. I've been having the same problems for a couple of months now, and in spite of assurances from "Dan Bertrand" "Senior IT Manager, Symantec Corporation", it hasn't stopped. He cited either a firewall issue (they don't operate it themselves anymore) or a bandwith issue. I don't buy either of them, I think it's their postfix + DNS setup. Somehow postfix is fed info that your domain does exist, but that there a no valid MX (or A ?) records. If there was a firewall issue, their resolvers should timeout, and their mailsetup should requeue.
--
Ehm... I'm not very creative
This is why lifetime in prison is possible for hackers. Stuff like this can be issues of "national security". If online businses went out for any noticeable amount of time, the U.S. GNP could see a noticable impact.
Blessed be he who reads this post, Cursed be he who tells my boss.
So as the battle weary sys admins from UltraDNS finally get back home from fighting a DDOS attack....
Phone rings.
"Bob, the web server is under attack again, and this one's coming from all around the globe. Game over man, game over."
Slashdot's a bitch.
Why was I moded "Flamebait"??
This is a DISGRACE!!!
My post is exactly the opposite of flamebait! It treats the female race with the uttermost respect, while delicately keeping the balance between leisure time and good taste.
Please fix the parent and mod it +1, "interesting", for the benefit of our female unsatisfied slashdot readers.
Thank you.
Hmm... that would certainly explain why I'm not able to find a single damn thing wrong. :) Thanks for that cross-reference data point!
Well, people need to have sex, don't you think? And it seems that the slashdot population ignores that, since there are hardly and sex-trolls around (besides of those gay imposters. No real gays, only kids who think that redirecting people to gay porn sites is cool).
I'm here to rememdy the situation.
Keitarou.
I'm going to wank now.
Since I just found out my OpenBSD box had been rooted for over a week this past weekend, I am in a foul mood concerning crackers, kiddies, and cyberpunks in general.
I say we take anyone that does something as painfully simple and desctructive as a DDOS, string them up by their short hairs, and then beat them about the head with reams of paper.
Why would they allow pinging anyways? Really, as a root DNS server, one would think that All they should allow are DNS queries and related. I suppose pinging might suck bandwidth, but just ignoring the pings helps on the server end?
There are some companies developing software, that upon an attack by zombied machines, the server will find the hole, and counter-hack, and completly diable the machine from continuing the DoS attack. Very interesting idea, and finally a way to fight back against the hoards of script-kiddie hackers that are responsible for most DoS attacks.
Yep, the Weekly World News, home of Bat Boy and "Iraqi Submarines Prowling Lake Michigan", has a giant headline in the issue I just saw at the checkout stand: TERRORIST PLOT TO BLOW UP INTERNET ON 1-11!"
The subheads are:
* Computer virus will destroy US economy!
* The US Military will be paralyzed!
* Electricity, food and water supplies vanish!
Clearly, we're ignoring these attacks at our own peril, when as technical a publication as the Weekly World News has picked up the story.
(Back to reality, I literally burst out laughing and almost dropped my Mountain Dew when I saw that headline. Blow up "The Internet". Sounds like my daughter's friends... they come over and ask if her computer "has the Internet on it". No, it doesn't, but it has *access* to the Internet. "Oh, you mean AOL?" Grrr...)
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.
DNS goes down for a few days, at least you have your favourite sites IP's memorised.. whats that? you dont? you call yourself a nerd?!?!
Can someone explain exactly what 'the edge' refers to?
Stifle anti-war web sites...
And you all thought DOS was dead!
Err.. Oh, heh... Denial of Service.....
*exits quietly*
If the root servers can't protect themselves... who CAN protect themselves?
_________ Help me get a PSP!
The service provides a couple of *supposed* advantages:
> Better latency. They use an anycast routing network which guarantees that a query to their DNS servers will be received and answered by the closest server based on the network topology. Even though there is only 2 published IP's for nameservers. There are some 16 servers scattered around the globe to answer on those IP's.
Yeah, but that's how DNS already works - caching servers choose the DNS server that responds the fastest to DNS requests. Also anycast networks have 1-5 minute delay to fail over to another network in the event of an outage. And there's no failover in the event of a brownout. Since DNS load-balancing operates at the application layer, caching servers can heavily optimize their requests.
> Near real time database updates. They use an Oracle advanced replication network to get updates out to the other servers in near real time.
Nearly all DNS software does this now. See BIND's : ndc reload "zone", and "notify" commands.
> Proprietary software. The only significant advantage here is that it's not BIND.
BIND has been attacked and repaired over and over. It has thousands of eyeballs on it, and hundreds of contributors from major firms. UltraDNS has never been a serious target, like say other big companies with proprietary non-Apache software. Experience shows that proprietary software is significantly less secure than open-source. Wait until some former disgruntled employee publishes the source, and see what happens. Oh wait, you *are* a former employee.
> The problem with your example is that chances are, your DNS server in LA will be getting queries for Europe, which isn't all that ideal. Once again, is it that important? Not really.
Except that right after the DNS gets hit from Europe, the website gets hit from Europe too, and really, there's where you will see issues (if any). As a percentage of time, "DNS hits" consume less than 1% of the time spent on a given web session. If you improve this by 20%, you've sped up your site but less than 1/5th of 1%.
Finally, if you decide to get a "replicated site" in Europe, just put a DNS server there too, and the euro traffic will, likely, hit it first.
Even better, turn off round-robin and zone replication, and have the euro server deliver the euro A-record first (same pattern with the others). Modern browsers will then fail-over in the presence of multiple A-records.
The worst thing about outsourcing, especially DNS, is that you are combining your site with 10,000 other sites on a single network. This creates a more attractive target to hackers.
The best thing about outsourcing is that they "do it for you". Which is really why anyone does it.
yesterday my internet connection kept "dropping" and then coming back. i use cable internet, but it seemed like a DNS problem because i could still ping ip addresses, just not hostnames. i wonder if this was a symptom of the DOS?
I don't know much about the UltraDNS stuff.. as for the other thing:
.com zone file then I suspect a rather large number of users would have had experienced some rather large problems.
7 or the 13 servers went down for a bit. And because of caching and redundancy this wasn't really a notticable thing.
It might be, however if a million windows boxes were comenced such an attack over days.
When it comes right down to it, I think the root operators are doing a pretty good job all things considered. (they're allready approaching ways in which to protect themselves)
However, if this had been an attack on verisign's
Their was a lot of force behind the blow, but the punch wasn't aimed well.
What's bothersome is that if this was used by somone who knew what they were doing. (That's assuming it was an attack and not a warning, or a test of some sort)
That UltraDNS is advertising itself as the most reliable DNS, and yet, it got attacked with a DoS? Reliable indeed....
-illumina+us "I put on my robe and wizard hat..."
Do you want to give control of an entire gTLD to one organization?
Hmm.. trolling for ICANN haters? I see no particular security problem with a central authority managing a TLD, provided that their backup servers are distributed widely in both the geographical and topological senses. We shouldn't confuse this particular issue with that of whether a central authority like ICANN should have the right to control who can and cannot create new TLD's.
So long, and thanks for all the Phish
that a DOS attack was when you went and installed MS-DOS on a computer rendering it inoperable.
"She's a West Texas girl, just like me" - G.W Bush Iraqis
It'd be quite easy to stop all of these ddos attacks....quit linking to other sites from slashdot
"Experience shows that proprietary software is significantly less secure than open-source."
BIND is an exception to this. BIND has an idiotic security record, bloat, and misdesign. Security hole monster. We all know it. Yet you are trying to make believe otherwise.
Actually thats pretty easy, you can turn it off at Turn off the Internet
You're either an engineer or a groupie. If Dan Bernstein's right, it doesn't matter if he's being a prick or a saint.
What in the world makes you think people doing real work need to meet your subjective "social" expectations?
Probabilistic packet marking is an idea to trace packets by coding trace info in unused header bits. Part of the trace info goes in each packet, so one needs many packets to get all the label. The info is placed in a small percentage of packets, so some packets contain info from earlier routers. A victim site will have many packets, so can assemble info for many routers through which the packets passed.
Has this been implemented yet?
Hi People,
I'm probably out of the hot-zone by now since the Backbone-ISP i worked for has gone bankrupt.
This is my experience however.
DDOS attacks cannot be stopped as long as the routers on the backbone are not set-up to do so.
Yeah, you read it right the first time. And we were not the only network to run without any specific setup to dynamically counter attacks.
Sure, there are preferences to configure a router so it can packet-filter and rate-limit DDOS-like traffic (very elaborate ones even) but some ISP rather dont do this since it would fry their precious machinery, and no this is not Microsoft equipement we're talking about here.
Bottom line i got on the root-dns-attack story is that the attackers stopped just-in-time not to choke these servers. Five minutes more and they would have gone belly up. But that might have been a story by itself.
I loaded this page and got a banner for "World's most Reliable DNS - UltraDNS - Bulletproof". Seriously. This is one of the things real editors at real news sources try to avoid :)
It's possible that the weird x.x.0.0 addresses were a programming bug (forgot to run a loop?), but my initial guess was that it was trying to trigger the old-style directed broadcasts (remember when all-zeros was the broadcast instead of all-ones?), guessing that many people have the sense to block all-ones directed broadcast.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Just kick over to Freenet, no DNS required.
;-)
Where am I gonna download a client without DNS?
Comment removed based on user account deletion
Get one of the Freenet guys (or, if an EFF guy is willing to help out again, one of them) to point out that Freenet is the *ideal* protection against terrorist attacks on the information infrastructure of the United States.
Consider all the "security" grants that are being thrown left and right at companies. They're lapping up all those tax dollars in the form of goverment contracts. If Freenet can grab just one, that would fund development for a long, long time. Lots of improvements, and I'd have a hard time imagining a more worthy cause than a more robust, secure, attack-resistant, private system that makes for more efficient transfers over the network.
The overwhelming majority of my university's CS research funding comes from the Department of Defense. Freenet couldn't snag just a few of that flood of dollars going to organizations aroudn the country?
May we never see th
4of12's suggestion would let the rootservers run a server that's only accessible from known (and presumably important) addresses, such as the DNS servers for the big ISPs. That would take care of the most important uses of DNS, since most people get their DNS queries answered by their ISP's servers, either from cache or from recursive queries. Letting the big ISPs do zone transfers from a protected net would preserve that. (Without zone transfers, an obvious attack is for the zombies to look for bogus000001.com, bogus000002.com, etc.)
Beyond that, DNS queries and zone transfers aren't the only way to send the information around. DNS A-record data compresses well (Unfortunately, DNSSEC data doesn't, and it's much bulkier.) And everybody wants the same data, so multicasting can be an efficient way to transmit it (using your favorite reliable-multicast application.) A back-of-the-envelope guess is that the dot-com namespace would compress to somewhere between 100-300MB, which would take 10-30kbps to transmit it in a day - and most of it has a TTL that's much longer, so you could handle it efficiently with incremental updates. Another alternative to multicast would be a peer-to-peer app that's designed for handling big files, like BitTorrent. (BitTorrent's designed more for static content rather than dynamic, so you'd need some file naming scheme for fetching today's version.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
is there any information on whether the DDOS attack on UltraDNS actually affected service?
The UltraDNS infrastructure has 16 or so machines on the same IP number. So it's harder to hit all of them. And it's not BIND, so it may be harder to bring down. (not sure it matters - the root DDOS didn't crash BIND either).
And of course UltraDNS is typically not serving all of the secondaries for a zone.
If anyone has real info....
In the following file you will find listed the IP addresses for all root servers. In case all DNS goes to hell, you can use this to look up any host name, be it COM/NET/ORG, any country, etc.
ftp://rs.internic.net/domain/root.zone.gzWhy kids, why not organized adults with financial resources?
The answer: WHY
Kids.. it's fun, it's destructive, it's a sense of power.. the reasons go on. I shouldn't have to explain them.. go back, I'm sure many of you can understand.
Adults.. and I'm not talking about big kids who never grew up here... need a finanical reason to do this. Could organized, intelligent hackers with financial backing to some serious damange to the internet? You better believe it. What would they have to gain? Not much. Prison. Hatred. Being labeled as terrorists, maybe killed.
What are you going to do? Hold the Interent for ransom? I doubt it.
That's why this stuff is chiefly done by kids, not grownups.
So, ultra DNS gets DoSed, then it get slashdotted too? They're having a great day!
Try actually thinking for yourself. It's quite refreshing.
On the other hand, see what happens if you type in just "CNN".
On IE on my mac, i get cnn.com.
On a Windows 98 computer i tried this on a couple weeks ago, it took me to a "search page" listing a number of sites. The top one, seperated from the others with a big screenshot of the front page and the words "featured link", was MSN.com.
I think CNN was on the list, only further down, but still, what the hell??
> Yeah, Linus is in the US.
...... ;-)
>
> His source trees are in Finland.
OK, someone give him access -fast-
-- babydr@nwrain.net, because of problems with the kernel
- this post brought to you by the Automated Last Post Generator...