Slashdot Mirror
Network Solutions Under Large-Scale DDoS Attack
netizen writes "CircleID is reporting a large-scale DDoS attack affecting all of Network Solutions' name servers for the past 48 hours, potentially affecting millions of websites and emails around the world hosting their domain names on the company's servers. The NANOG mailing list indicates that it is due to a very large-scale UDP/53 DDoS which Network Solutions has also confirmed: 'There is a spike in DNS query volumes that is causing latency for the delay in web sites resolving. This is a result of a DDOS attack. We are taking measures to mitigate the attack and speed up queries.""
Does Network Solutions have any network solutions?
Rebooted the DNS server today cause things seemed funny ... maybe this is what it really was.
Wow, never seen a red posting. . . this going to be something new /. does?
Nice we can link to something in their domain to further add to the DNS traffic! Maybe someone could find a link to download some huge file from their servers, too!
I don't know, but it works for me.
ATTENTION SHOPPERS: PAY NO ATTENTION TO THE NECROTIC DOG PENIS. I REPEAT, PAY NO ATTENTION TO THE NECROTIC DOG PENIS CURRENTLY LOOMING OUTSIDE LOT 4. CONTINUE SHOPPING BUT PLEASE ENSURE YOU LEAVE VIA AN ALTERNATIVE EXIT AS WE ARE NO LONGER ABLE TO GUARANTEE YOUR SAFETY IN LOT 4, DUE TO THE NECROTIC DOG PENIS. FOR YOUR INFORMATION, LOTS 1, 2, 3, 5 AND 6 ARE CURRENTLY FREE OF BAYING NECROTIC DOG PENIS. PAY NO ATTENTION TO THE NECROTIC DOG PENIS. THANK YOU.
Sorry guys, these OC-768s can get a little squirrely running uTorrent.
Thank you, Edward Snowden.
"Arguments from authority are worthless." —Carl Sagan
Here is a update that we posted on the Network Solutions Blog (http://cli.gs/GEWSs0) : DNS queries for web sites should be responding normally. Thank you all for your understanding. As always, we will continue to work to take measures to prevent these and other types of technical issues caused by third parties that may impact our customers. Thanks, ShashiB
Social Media Swami | Network Solutions | http://blog.networksolutions.com
Actually I did change the forwarders and restarted the service, no reboot, just a bad description.
A perfect opportunity to use that normally B.S. excuse: "Why, no, I didn't get your email. Must've been because of that DDoS attack on the name servers."
In theory, this could be the true intentions of Conficker.
I thought such attacks were a thing of the past. I am disappointed. But on a serious note, is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?
This happened Tuesday and Network Solutions has restored service, therefore, this story is moot.
http://blog.networksolutions.com/2009/potential-latency-on-network-solutions-dns/
Man, am I getting old. This shit used to be relegated to print sci-fi, now its reported like the weather. The first thing I'm thinking is "will this prevent me from working from home on Monday?"
I'll do to the only thing I can think of: I'll invoke a friendly spirit: "Wintermute! Help us!"
If your only tool is a hammer, every problem becomes a nail.
That would help to explain the surge in this kind of thing in the last few days.
15:07:13.666770 IP 63.217.28.226.17498 > 158.64.65.65.53: 36407+ NS? . (17)
15:07:13.750783 IP 63.217.28.226.61231 > 158.64.65.65.53: 46118+ NS? . (17)
15:07:13.831834 IP 63.217.28.226.44626 > 158.64.65.66.53: 51544+ NS? . (17)
Except that that source IP address doesn't look like a Network Solutions address to me.
Is it possible that there is a DDoS technique where the source IP addresses on DNS packets to 3rd party DNS servers are spoofed so as to generate the appearance of an attack from a different source? I guess that's what they're saying. But it doesn't seem to multiply the power of an attack much. They just get 17 bytes of DNS response from each 17 byte request.
It's all a bit confusing really....
Now correct me if I'm wrong, but if the mafiaa's legal theory on "making available" is right, doesn't that mean that any company which makes available software which is easy to turn into a DoS zombie should be held liable. And the people who let their computers become zombies should be held liable for making their machines available to become zombies.
Not only that, those made-available computers actually _are_ exploited for evil acts.
So aren't the purveyors of dodgy software liable for damage caused by DDoS attacks?
Blaming the DDoS controlling people for the attacks is a bit like blaming the downloaders of music/videos for downloading copyright stuff instead of blaming the makers-available.
Just a thought....
The problem seems to kick in for DNS servers that arent rejecting the queries. Someone is channeling ye 'ole smurfing methods.
They're requesting a list of all DNS root servers. If the server don't reject the query, a 17 byte query becomes a 50k response (or something like that) to the spoofed address.
.
That would explain why access to the drudgereport page has been off and on. DNS failure would do it.
Administrative Contact :
Drudge, Matt
rg3kn2zw89n@networksolutionsprivateregistration.com
ATTN: DRUDGEREPORT.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA 20172-0447
Phone: 570-708-8780
Technical Contact :
Drudge, Matt
rg3kn2zw89n@networksolutionsprivateregistration.com
ATTN: DRUDGEREPORT.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA 20172-0447
Phone: 570-708-8780
Record expires on 15-Feb-2013
Record created on 14-Feb-1997
Database last updated on 29-Feb-2008
Domain servers in listed order: Manage DNS
NS6.HA-HOSTING.COM 64.73.222.3
NS1.HA-HOSTING.COM 66.28.209.220
NS4.HA-HOSTING.COM 8.10.64.46
NS2.HA-HOSTING.COM 8.10.64.38
NS5.HA-HOSTING.COM 66.234.135.94
NS3.HA-HOSTING.COM 66.28.209.221
Life is not for the lazy.
Except that in many jurisdictions the criminal activity of others cuts off liability. IE if Microsoft provides software, and someone else exploits it, the criminal activity of the third party cuts off liability to Microsoft.
In the name of those who use and maintain networks would like to thank Microsoft. This great corporation has made the work of various attackers possible by providing a working frame work. All thanks to decision made by it's management to keep flawed technologies on Windows long after they have penetrated more times than Paris Hilton. Zing!.
Well, in the firearms manufacturing industry it is called Proof Testing, and is a good thing.
But you might still want to don some protective gear, maybe find a fallout shelter, etc....*alarms sound* Warning! Servers going critical! Eject the warp core immediately! Warning! Servers g
Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
*spoiler alert* - but if you haven't read these books yet, you're either very young, or not a geek. Wintermute was trying to overcome his programming, which was keeping him and Neuromancer separate. I believe. It's been a long while since I read the books.
I was getting a lot of messages that looked like named[2476]: client xx.xx.xx.xx#22707: view external: query (cache) './NS/IN' denied
Comment removed based on user account deletion
OK.
The RIAA's legal theory is in the context of copyrights and illegal copying. It simply does not apply here. Microsoft own the copyright on their stuff, so they are free to make it available.
I wonder if this is related to this http://isc.sans.org/diary.html?storyid=5713
Darn, you're making me feel nostalgia all over, again!
Those guys are asses anyway.
GoDaddy kicks ass.
First, said doctrine is not correct even in the intended context.
Second, just because you can use some of the same words does not mean that your armchair legal theory has anything to do with their legal theory. That said, it is equally correct (which is a nice way of saying wrong).
http://www.dnull.com/dos/DOS-Block.htm
**sigh**
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
Don't block the requests, the requester IP is spoofed so that DNS servers which respond with root hints forward them to the innocent party, causing DoS. Vlocking the IP just blocks the innocent party's DNS servers. Just make sure that you don't respond external recusive queries.
POKE 36879,8
They spoof the ip in order to avoid the auto router blocks that kick in when an (one) ip triggers the attack detector.
It's a spoof. The attacker sends requests to lots of different nameservers with a spoofed return address. Those servers respond to that address as normal. The target suddenly gets a lot of DNS traffic from all over the place. Instant amplification attack.
(Gross simplification, but it's late and someone else can explain the details.)
this is my sig
yes, that's exactly what's happening. this is nothing new at all, and, in fact, these kinds of attacks have been done using DNS backscatter for years. it's just a generic "amplification" or "reflection" attack, if you will (the same concept as smurf/fraggle and many others).
are you actually running a nameserver? it would be interesting to know where they got their list of nameservers. perhaps they just did a generic query on google to get a list of domains and are using authoritative servers to do look-ups. they wouldn't have found mine by scanning, since I don't allow recursion (well, it would be useless to try use me as an amplifier).
I was just thinking yesterday about how the humble virus had grown. I was wowing over the Amiga 500 my friend's older brother had bought (with his very own money!), when said older brother caught us creeping around in his room.
But instead of tossing us out like the brats we were, he came in and fired it up to show it off to us in a casual display of older-geek coolness I was deeply impressed by. The guy was hard core, heading off to study at MIT in a few months time. The best I'd ever done for geek-cred was to assemble an old Apple II by soldering where the mother board said to soldier without really knowing much about the why or wherefore, so this guy, who had built his own memory circuits on breadboards just to see if he could. . , he seemed like Batman to me. Damn, he was so cool, he even had a *girlfriend* during high school.
So he hung out with us for a while and brought us up to speed on all the coolest things going down in the world of geek lore, one item of which was that there was such a thing as the, "Computer Virus".
The concept seemed utterly sci-fi to me, and it caught my imagination like a torch. I remember wandering home with a multiplying flow-chart of possibilities developing in my mind, all leading to. . , well today actually.
The funny thing is that whenever the 'future' does happen to show up, it always seems to feel suspiciously like another bland variation of 'today', --and it never contains flying cars or Harrison Ford running around looking wounded and armed and trench-coaty. For some reason, no matter how I envision the future, it always involves imagery from Blade Runner. Either that, or the Happy Ending from one of those Sid Meyer games.
I guess we're lucky both ways.
Cheers!
-FL
It's a spoof but not the problem network solutions has/had
New things are always on the horizon
I think it is still an interesting question to consider if there is any liability to Microsoft for damage caused by a virus hosted on their OS.
My instinct is that there isn't, as it is perfectly possible to run Windows virus-free, with varying levels of difficulty. Also, in this case Microsoft made a patch available, so the OS as provided by Microsoft is immune to the attack.
All intents and purposes. Not intensive purposes.
I can confirm something unusual is occurring in the last 24 hours at least with several of my domain NS being target of NS? root queries from IPs apparently of to "Beyond The Network America, Inc." an uncertain denomination based in VA according to WHOIS.
The "thing" generally hits all name servers from a certain domain with packets coming from the same IP, 2 to 10 per minute, it's about 4kb inbound bandwitdh "noise" wasted (and now filtered), nothing more in my case, move along, but, hell, once a time 4kb were a lot.
Besides would be nice to know what's behind it and get it off. I wonder if anybody else has the same experience.
In a note I can't but be saddened how here in Slashdot it's full of trolling and teasing nowadays, a time ago there was some interesting geekish talk too now and then...
It's a reflection attack. Send a small query that requires a bigger answer to a bunch of nameservers. Spoof the source address for the query.
Here's what I'm seeing of this attack.
what the hell does this have to do with netsol? the traffic from this ddos is originating from isprime and something called "beyond the network inc", both american companies.
a 17 byte query becomes a 50k response (or something like that)
I haven't tried to figure out the exact numbers, but my tcpdump files of a root NS query and its response have been about 100 and 300 bytes respectively.
Oh, here: dig reports "MSG SIZE rcvd: 300".
Still, a DNS amplification attack. (Not a smurf attack, though that's another reflection/amplifcation attack, but it's specifically with pings.)
my thoughts exactly...
what the hell does this have to do with netsol? the traffic from this ddos is originating from isprime and something called "beyond the network inc", both american companies.
Slasdot sez:
And at http://www.circleid.com/posts/20090123_network_solutions_down_ddos_attack/ we find:
Watch this Heartland Institute video
Exactly. The attacker spoofs UDP DNS queries and sends them to third-party DNS servers. They respond to the spoofed, victim's nameservers. The idea is that the attacker sends a small packet which induces a large response ('amplification') from the third party to the victim.
Incidentally when did Network Solutions change their name to "IsPrime"?
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
maybe if people would turn off the
ip to domain name resolution(sic) feature in
uTorrent, when they click on the "peers" tab ; )
A communications disruption can mean only one thing...
Keep your eyes peeled for those Trade Federation landers.
(Yeah, just kidding. Here's the real page.)
--
Toro
http://starwars.wikia.com/wiki/C-9979_landing_craft
Bet you thought I should turn in my geek card, eh?
--
Toro }B^>
Netsol sux anyway.
Anyone else notice how they send out notices with the FROM: address forged as the TO address? Most people would get sued for fraud.
---- Booth was a patriot ----
The only obvious reason to DDoS a bunch of DNS servers is if you're going to be doing some cache poisoning and mounting a massive MITM attack, and if you're lucky you recently obtained a trusted intermediate CA via an MD5 collision attack on a lousy root CA like RapidSSL.
Has anyone bothered to petition Mozilla to remove all the offending root CAs with the weakness shown in MD5 considered harmful today?
Comment removed based on user account deletion
I'd noticed that all my DNS queries for non-existent domains were actually returning NXDOMAIN, instead of an advertisement...
MS isn't going to be liable until they are, either by law or contract, obliged to third parties not to make an infectable OS.
I'd like resilience to viruses be a required safety feature, much like guards are in heavy machinery, and I would also like lack of said resilience be a case of product liability.
Given how deep MS probably is in the pockets of congressmen, I doubt they'll get any such standard laid upon them.
No read their EULA. With MS you have no protection.
Even with EDNS 4k is the largest response current nameservers will emit.
None of this 50k garbage.
The response to this query will be = 512 bytes as they use plain DNS.
With EDNS it would be a little larger but not much.