Slashdot Mirror
EveryDNS Under Botnet DDoS Attack
mellow marsh writes "EveryDNS, sister company to OpenDNS (which runs the PhishTank anti-phishing initiative), has been hit by a massive distributed denial-of-service attack. The attack started sometime Friday afternoon and, from all indications, was targeting Web sites that used free DNS management services provided by EveryDNS. At the height of the DDoS bombardment, EveryDNS was being hit with more than 400mbps of traffic at each of its four locations around the world. From the article: '"We were collateral damage," Ulevitch explained... Because law enforcement is involved, Ulevitch was hesitant to release details of the actual target but there are signs that some of the targets were "nefarious domains" that have since been terminated.'" OpenDNS, which makes use of EveryDNS services, was affected for a time, until they spread their authoritative DNS more broadly. The EveryDNS site is now reporting that the attack is continuing but has been mitigated and is not affecting operations.
/., like kicking a dead puppy.
"The EveryDNS site is now reporting that the attack is continuing but has been mitigated and is not affecting operations." O Rly. I see it reporting a chunky man with bad hair holding an @. Please change link to everydns dot NET to continue the /. DDoS.
This really made yesterday difficult for me.
My comp sci networking class assignment was on my home server, and I use EasyDNS. Had to bus home and put it on a USB stick. Last day of class, and the end of a particularly brutal week.
How about linking to the correct url?
The site is EveryDNS.Net.
:-)
I'll keep it up for Slashdot, let me just move it around a bit.
-david
# Hack the planet, it's important.
Nothing helps out a site currently under a DDoS attack like being linked to on the front page of /.
No, GP didn't. mbps == millibits. Mbps == megabits. MBps = megabytes. Read GP again, and pay attention.
Since I've been getting a lot of questions from folks about EveryDNS, how we've been stable and around so long, how we dealt with this DDoS and how we manage to cover our costs I am writing a response that will probably be posted here on Slashdot tomorrow or Monday to answer all these questions.
If you have questions about this or DDoS in general, feel free to ask them here and I'll make sure to cover them in my response. I'll be writing about what we've seen and what I generally do when it comes to soaking up traffic and how we handled this event in particular. (The short answer: find the smartest people you can to help you and then start taking corrective action)
Thanks!
David Ulevitch
# Hack the planet, it's important.
A client (a pretty large retail chain) was using EveryDNS for forward lookups to the mail server's A record. Mail they were sending out started to bounce because receiving mail servers weren't happy when trying to validate the sending box. In once case, a vital piece of mail sent to a state taxing authority couldn't get through on a month-end calendar deadline, causing much grief. Yes, alternate communcations channels are always an option, but it wasn't immediately clear why the two mail servers in question appeared to be hating each other.
Worse, the state government box's spam filtering appliance blacklisted the retailer's server, and a third party admin had to get involved to free things up. Quite a mess.
But the real lesson? People who say that a "cyber attack" couldn't really hurt the economy are wrong, wrong, wrong. This stuff can be really disruptive, and this was a pissant little scaled-down example. No major damage, but a lot of thrashing around, untold manhours of lost productivity, and (in the case of the anecdote in question, involving just one retail company), probably some tax fines which will require much tail chasing to get waived once the the story is clearly told, assuming the state government in question is feeling sporting about it.
Don't disappoint your bird dog. Go to the range.
What is "nefarious"?
to some.. the pirate bay and allofmp3 are "nefarious domains"..
to others "www.f**Ktimewarner.com" and "walmartsucks.com" are "nefarious domains"
and to others "www.wikipedia.org" and "www.aclu.org" are "nefarious domains".
I have a lot of trouble with the idea that DDOS attacks were being carried out in (apparently successful) attempts to wipe domains off the face of the earth..
this implies the attackers had no legal standing to take those domains offline.. then they call them "nefarious" after the fact.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
Compromised Windows machines network.
Where are the class action suits against Microsoft for continually producing such flawed software that makes it easy to 0wn a box?
If it wasn't for 20 some years of MS indifference towards security, there wouldn't be botnets like this, being used for DDOS attacks and forwarding billions of spams a day.
Guaranteed! This comment 100% Anthrax free!
You're pricks.
/. and in usenet).
Nothing positive or lasting will come out of trolling (and yes: this means you anonymous asshats on
So why not be part of a winning team and stop script kiddie'ing around from your parents basement.
Sincerely,
The Rest of the Human Race.
Someday, I'll have a real sig.
Did anybody else read this as "Every DNS Under Botnet DDoS Attack"?
The problem is, EasyDNS could only afford an AOL dialup to put their servers up. On top of that, the "server", is really just an old Pentium MMX with 32megs of RAM running bind on top of cygwin on top of Windows 95. Unfortunately, the admin let his 16 year old sister use the machine to browse MySpace (and who knows what else), so let's just say the machine is running other "services" as well.
In once case, a vital piece of mail sent to a state taxing authority couldn't get through on a month-end calendar deadline, causing much grief.
Maybe a)it shouldn't be left until the deadline and b)sent via email, if it's so damn important.
And maybe you not tell clients to use a free DNS hosting service as their sole DNS provider...
Please help metamoderate.
What reason could there be for botnet owners to attack EveryDNS? I can't see that they'd gain anything from it.
It's an indirect attack against people who use EveryDNS to get traffic to their own sites (or mail servers, etc). If you ran, say, an online casino, and your main competition for a particular type of customer happened to have EveryDNS doing their forward lookups... and you could shut down your competition for at least a full business day by torpedoing the DNS they need to be seen - presto, done. EveryDNS wasn't the target, their customers were the target.
Don't disappoint your bird dog. Go to the range.
Myself, a month ago I missed an opportunity to collaborate on a TV miniseries. Why? Because the moron who asked me for my collaboration absolutely trusted e-mail, and it was **THE** message that bounced thanks to a network glitch, and that moron didn't think of calling me on the **PHONE**. Well, if they were stupid enough to trust e-mail like that, they probably would have made a crappy miniseries anyways.
For casual communications, there is e-mail.
For vital ones, there is registered mail, fax or phone.
Because nobody has broken into the dog and forced it to bite somebody.
I use DNSPark, and they were subject to a DDOS attack earlier this week, too. Are they affiliated with EveryDNS too, or is it coincidence, since they are another cheap/free DNS host?
Never start vast projects with half-vast ideas.
Don't hate the guy you replied to because his UID is freakin' 18!!! :^)
If your upstream provider can't handle 400Mbps of traffic then you're being hosted by a pretty shitty ISP/data-center. It's not like gig uplinks are expensive (even if you only commit to a tiny rate you can generally get gig uplinks). Spread this across 4 or more datacenters and you've got a lot of bandwidth.
Not to mention that networking people generally don't give a shit about bandwidth- it's packets per second that kill routers, not bandwidth. Assuming 100 byte packets that's about 4Mpps- Even a basic 7600 can handle this kind of traffic. Assuming 30 byte packets (can't be smaller than that) you're talking about 15Mpps. Again Even a basic 7600 should be able to handle that- not to mention a Juniper M7i or similar. Most Foundry equipment would laugh at that rate. All of these routers can do ACL's at full packet rates.
That said- other recent DNS attacks exceeded 1.5 Gigabits per second of traffic and were a lot more vicious than the attack being described here.
I'm not knocking EveryDNS- I know what a bitch dealing with a DDoS can be- the problem tends to be that most people aren't ready to deal with it. Using BGP community based nullrouting most service can be restored within seconds of the target IP(s) being identified. That allows admins to keep untargeted systems and services up while the attacked systems are dealt with. The admins can then use the time to locate some/any pattern in the attack or enable the appropriate filtering such as a Cisco Riverguard or similar.
-sirket
Not quite- It generally works like this:
First off- be prepared for a damned attack and don't wait til it happens. When an attack does come:
1- Identify the target IP address
2- Immediately null-route traffic for that address (preferably using BGP community based null-routing)
This gets the rest of your systems back up and gives you time to work on the problem.
3- Try to identify a pattern in the attacking traffic- use a product from a company like Mazu- or just tcpdump if you're good with sed and awk.
4- If there is a pattern ask the upstream ISP to block based on that pattern (same source port, same source IP, same TTL, whatever). Or block it yourself if you have the router and bandwidth capacity to deal with the attack yourself- though that's generally a waste of your resources.
5- If there is no pattern but the traffic is malformed then enabled a Cisco Riverguard or similar protection device that can filter out malformed traffic at the higher protocol layers. As an alternative, sign up for such a service form a company like Prolexic.
6- Remove your null route and see how you did.
7- If you can't afford a protection service, you can try moving the host/dns records to new IP's. Sometimes the attacks don't follow- sometimes they do. It's often worth a try as it can be done faster than enabling protection services in many cases. In this case leave the old null route in place until the attack stops. Be prepared for the attack to return at any time once they realize what's happened.
Make sure to keep traffic logs for law-enforcement and to share with other ISP's so that they can track down the offending bots.
In the future try to keep your traffic as segregated as possible such that an attack on a single host will not take down too many other services should you need to null-route that address for an extended period of time.
The easiest solution- block all IP addresses assigned to the APNIC region and watch as your site immediately returns to normal. Sadly most of the DDoS's I've seen recently had the majority of their traffic sourced from APNIC addresses.
-sirket
Learn to spell, get a clue.
There is nothing you can practically do to prevent someone on the internet from sending a packet addressed to you, nor two packets, nor 1000000. There is nothing you can practically do to prevent the source address on each of those packets to be different. If a DOSer has much bigger pipes than you, you are sunk, unless you can do something very smart. For a start, getting remote access to your server during a DOS attack is tricky unless you have redundancy. Then you need to profile the traffic, find patterns which you can filter.
The non-triviality of a (D)DOS is the reason why everyone is interested to learn how to defend against such attacks. This is why we want to hear how EveryDNS handled the problem so well. A second-rate admin would not be able to. While I appreciate your sentiment regarding "survival of the fittest". I feel it can be better expressed as "survival of the fittest admin for the job".
As there are lots of admins on
'1. Identify the target IP address'
It's a *distributed* attack. That means more than one address. A lot more.
'or just tcpdump if you're good with sed and awk.'
You're going to be able to do this on 1.6Gbit of traffic in realtime? That's good typing.
'The easiest solution- block all IP addresses assigned to the APNIC region and watch as your site immediately returns to normal.'
FUD. This is a botnet attack. Most owned PC's live in the US. It's this kind of thinking that has forced us to run our servers in the US, because as everyone knows, New Zealand is in Asia.
I'm glad you're not supporting our networks (: