Slashdot Mirror

← Back to Stories (view on slashdot.org)

Network Solutions Under Large-Scale DDoS Attack

Posted by Soulskill on from the but-they're-so-friendly dept.

netizen writes "CircleID is reporting a large-scale DDoS attack affecting all of Network Solutions' name servers for the past 48 hours, potentially affecting millions of websites and emails around the world hosting their domain names on the company's servers. The NANOG mailing list indicates that it is due to a very large-scale UDP/53 DDoS which Network Solutions has also confirmed: 'There is a spike in DNS query volumes that is causing latency for the delay in web sites resolving. This is a result of a DDOS attack. We are taking measures to mitigate the attack and speed up queries.""

102 of 139 comments (clear)

  1. One must ask... by Anonymous Coward · · Score: 5, Funny

    Does Network Solutions have any network solutions?

    1. Re:One must ask... by Anonymous Coward · · Score: 1, Insightful

      Does Network Solutions have any network solutions?

      Be economical:

      Does Network Solutions have any?

  2. hummm by WillRobinson · · Score: 3, Interesting

    Rebooted the DNS server today cause things seemed funny ... maybe this is what it really was.

    1. Re:hummm by Anonymous Coward · · Score: 4, Informative

      Rebooting is what you do to Windows boxes. Unix is what you use for important things like DNS.

    2. Re:hummm by WillRobinson · · Score: 1

      Do not know what your really talking about, been self employed for 8 years. Have a mix of windows and linux systems, which are really for my own needs.

      Sorry no job security here. Its do or die.

    3. Re:hummm by ScrewMaster · · Score: 1

      Sorry no job security here. Its do or die.

      I had a consulting business for about fifteen years ... yeah, it's do-or-die all right. But as my father used to say (he ran several engineering and consulting businesses in his life) "it's the life if you can handle it."

      --
      The higher the technology, the sharper that two-edged sword.
    4. Re:hummm by symbolset · · Score: 2, Insightful

      The best opportunity shares space with the greatest risk.

      --
      Help stamp out iliturcy.
    5. Re:hummm by MoogMan · · Score: 1

      Way to go generic statement man!

      A redundant architecture is what you use for important things like dns, which reduces the impact of the decision of what OS you use.

      Many (inexperienced) linux admins like to reboot their boxen too remember

    6. Re:hummm by nabsltd · · Score: 2, Insightful

      Many (inexperienced) linux admins like to reboot their boxen too remember

      I've seen many times when issues required a reboot of a *nix machine.

      The latest one I'm dealing with is a machine that completely drops off the network (no pings, etc.). Restarting services has no effect, so we suspect it is hardware, but that doesn't make a lot of sense, because the obvious culprit (the network cards) have physical redundancy and pass all diagnostics. We've also swapped out cards, but still see the same thing. The next step is to move to a card that uses a different driver, but that's something that requires change control to get involved.

      It only happens about once every two months, and since the machine itself is part of a cluster, it doesn't hurt productivity much, but it is annoying.

    7. Re:hummm by innerweb · · Score: 1

      "it's the life if you can handle it."

      Let me suggest "it's the life if your family can handle it.".

      InnerWeb

      --
      Freud might say that Intelligent Design is religion's ID.
    8. Re:hummm by ScrewMaster · · Score: 1

      "it's the life if you can handle it."

      Let me suggest "it's the life if your family can handle it.".

      InnerWeb

      Yes and no. I know what you're saying, and generally speaking you're entirely correct. On the other hand, there's a distinct lack of employment stability in the tech world right now. I might add that there are a lot of people who like it that way (mostly upper management types.) Decent benefits are on the way out, job security is a thing of the past: really, few of us are comfortable with our corporate futures.

      So yes, you may have a job ... but for how long? At least my father (and I, once I followed in those footsteps) didn't have to worry about losing that one paycheck. I had multiple clients at multiple large corporations, and for the most part was more secure then many of my full-time counterparts. Granted, I had to work really hard to make that happen (much harder than most of my full-time counterparts) but there it is.

      Hah, more secure than I am now. Yes, I've held the same full time position for the past decade, but I don't consider myself "secure." I work in an at-will State, and if the power-that-is decides that my services are no longer required, well, that's that. I'll be out in the cold as a senior software engineer in a job market that doesn't value knowledge, talent or experience anymore.

      Sometimes I think I should never have quit the contract game. Other times I think I'll end up back in it whether I want to be or not.

      --
      The higher the technology, the sharper that two-edged sword.
    9. Re:hummm by amorsen · · Score: 1

      Check for messages about IRQ's being disabled. Do the counters in ifconfig keep counting?

      Restarting services is unlikely to help.

      --
      Finally! A year of moderation! Ready for 2019?
  3. Slashdotting will help how? by nwf · · Score: 5, Funny

    Nice we can link to something in their domain to further add to the DNS traffic! Maybe someone could find a link to download some huge file from their servers, too!

    --
    I don't know, but it works for me.
    1. Re:Slashdotting will help how? by narcberry · · Score: 1

      Seeing as they are the .com owner (and others), you'd have a hard time NOT impacting their DNS servers.

      --
      Modding me -1 troll doesn't make me wrong.
    2. Re:Slashdotting will help how? by epiphani · · Score: 4, Informative

      Hi! You're wrong. That would be Verisign.

      This is DNS hosting provided by Network Solutions for people who buy domains from them and choose to have them host the DNS rather than host it themselves.

      Thanks for playing.

      --
      .
    3. Re:Slashdotting will help how? by narcberry · · Score: 1

      *pssst* Verisign owns Network Solutions owns .com

      --
      Modding me -1 troll doesn't make me wrong.
    4. Re:Slashdotting will help how? by poopdeville · · Score: 2, Insightful

      Maintain a cache of domain records from an authoritative source (which can be itself, in the case of the 11 root servers or internal network domain name servers).

      Oh, you were trying to make the GP look dumb. Failure.

      --
      After all, I am strangely colored.
    5. Re:Slashdotting will help how? by Phroggy · · Score: 2, Informative

      *pssst* Verisign owns Network Solutions owns .com

      That hasn't been true in years.

      NSI originally operated the .com/net/org/edu registry and was the sole registrar; after they started allowing competing registrars, Verisign bought NSI, then Verisign spun off NSI as a registrar but kept the registry. NSI now competes on even footing with other registrars (except NSI's customer base dates back to before competition existed).

      I'm tired, I'll let somebody else correct my oversimplifications and misstatements. :-)

      --
      $x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
      $x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
  4. Re:Red headlines? by clarkkent09 · · Score: 2, Informative

    Subscribe and you'll see them all the time

    --
    Negative moral value of force outweighs the positive value of good intentions.
  5. Shashi B at Network Solutions by shashib · · Score: 5, Informative

    Here is a update that we posted on the Network Solutions Blog (http://cli.gs/GEWSs0) : DNS queries for web sites should be responding normally. Thank you all for your understanding. As always, we will continue to work to take measures to prevent these and other types of technical issues caused by third parties that may impact our customers. Thanks, ShashiB

    --
    Social Media Swami | Network Solutions | http://blog.networksolutions.com
    1. Re:Shashi B at Network Solutions by TheSeer2 · · Score: 3, Funny

      A shortened url? On /.?

      http://blog.networksolutions.com/2009/potential-latency-on-network-solutions-dns/

    2. Re:Shashi B at Network Solutions by symbolset · · Score: 1

      Can we blame W32.Conflicker yet or do we have to wait?

      Does this DDoS run Linux or OS-X?

      Really. We want to know.

      --
      Help stamp out iliturcy.
    3. Re:Shashi B at Network Solutions by kitgerrits · · Score: 1

      On a serious matter:

      Thanks for stopping by in person for the heads-up.

      I Appreciate it.

      --
      "I was in love with a beautiful blonde once, dear. She drove me to drink. It's the one thing I am indebted to her for."
    4. Re:Shashi B at Network Solutions by kisielk · · Score: 1

      Thanks for informing us on your blog. However, it's a little bit too little too late. We were trying to track down the problem with our network services for a while yesterday before we clued in that it was an NS problem and had to call to verify. How about some way of directly notifying your customers immediately when there are problems like this? A low-volume notification-only mailing list? A more filtered blog? No I'm not interested in reading about "Solutions Out Loud Podcast Episode #6 - âoeThe Inaugural Ballâ Episode". Real news would just be lost in the noise...

    5. Re:Shashi B at Network Solutions by shashib · · Score: 1

      You mean a RSS feed for service notifications only? Good idea. Let me work on that.

      --
      Social Media Swami | Network Solutions | http://blog.networksolutions.com
    6. Re:Shashi B at Network Solutions by sloth+jr · · Score: 1

      It really and truly doesn't matter; ultimately, the cause of this are misanthropes, regardless of the platform used to amplify this attack.

    7. Re:Shashi B at Network Solutions by symbolset · · Score: 1

      Yeah, it's got nothing to do with open ports and autorun enabled by default. That would be crazy talk.

      --
      Help stamp out iliturcy.
  6. mistatement by WillRobinson · · Score: 3, Informative

    Actually I did change the forwarders and restarted the service, no reboot, just a bad description.

  7. perfect by Anonymous Coward · · Score: 2, Informative

    A perfect opportunity to use that normally B.S. excuse: "Why, no, I didn't get your email. Must've been because of that DDoS attack on the name servers."

  8. Someone should be fired! by bogaboga · · Score: 1, Flamebait

    I thought such attacks were a thing of the past. I am disappointed. But on a serious note, is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?

    1. Re:Someone should be fired! by ColdWetDog · · Score: 5, Funny

      is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?

      I've heard that unplugging the network cable works OK.

      --
      Faster! Faster! Faster would be better!
    2. Re:Someone should be fired! by timmarhy · · Score: 3, Informative

      you can't prevent them. they come from legit clients that have been infected with a virus. you can block the traffic by dropping traffic that matches the attach pattern, that's about it.

      --
      If you mod me down, I will become more powerful than you can imagine....
    3. Re:Someone should be fired! by Anonymous Coward · · Score: 5, Insightful

      Do you even know what a DDoS attack is?

      If you did, you'd realize you can't both operate a service online, and be immune. The two things are mutually exclusive.

      The best you can do is slap the attack down when you see one happening. Even that isn't exactly easy. Banning a few million IP addresses tends to be a problem all by itself.

    4. Re:Someone should be fired! by Charles+Dodgeson · · Score: 1

      is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?

      I understand that you can purchase protection against such things. The Russian Business Network would be a good place to start. After all, in Russia the criminals protect you.

      --
      Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
    5. Re:Someone should be fired! by epiphani · · Score: 1

      I thought such attacks were a thing of the past. I am disappointed. But on a serious note, is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?

      tl;dr: no.

      You can do quite a bit to reduce the risk and react well to the situation, but as long as you're on the internet and there are botnets, DDOS is possible. It might even look like too much "normal" traffic. Given this is a DNS attack based on DNS traffic, its quite possible the only reason they know its a DDOS is because its a whole hell of a lot more traffic than usual.

      Unless you spend tens of billions on infrastructure, you're not very resilient. Even IF you do, that doesn't mean certain pipes cant be filled and certain sections of the internet become unreachable.

      --
      .
    6. Re:Someone should be fired! by bogaboga · · Score: 1

      I know bad guys have tried to take on Google at some point in its history. Have they ever succeeded to any extent? After all nobody is "immune."

    7. Re:Someone should be fired! by inKubus · · Score: 2, Funny

      Easy:


      cat "216.34.181.45 slashdot.org" >> /etc/hosts

      Any other questions?

      --
      Cool! Amazing Toys.
    8. Re:Someone should be fired! by totally+bogus+dude · · Score: 5, Funny

      ...and so ends the era of "useless use of cat"; now begins the era of "completely nonsensical attempt to use cat".

    9. Re:Someone should be fired! by passion · · Score: 2, Informative

      Not quite - you're thinking of older versions. Modern versions of Peakflow are teamed with TMS (Threat Management System), which allow you to mitigate DDoS attacks.

      From their website, "Surgical Mitigation Arbor Peakflow SP TMS enables you to automatically detect and surgically remove only the attack traffic while maintaining legitimate business traffic â" thereby ensuring the highest level of customer satisfaction."

      http://www.arbornetworks.com/en/threat-management-system.html

      --
      - passion
    10. Re:Someone should be fired! by something_wicked_thi · · Score: 1

      Not if it's him getting fired. Maybe that's what he meant.

    11. Re:Someone should be fired! by kitgerrits · · Score: 1

      There are 2 ways I use cat like that:
      1/ 'sudo cat'
      2/ as placeholder for another program (awk/grep/head/tail)

      I realize that those programs also allow the use of stdin, but It still find if convenient.

      Nasty apppend-as-root hack (>>): 'sudo tee -a'

      --
      "I was in love with a beautiful blonde once, dear. She drove me to drink. It's the one thing I am indebted to her for."
    12. Re:Someone should be fired! by cloudmaster · · Score: 1

      Other than "why do you have a filename which contains a space" and "what's in that file"? :)

    13. Re:Someone should be fired! by inKubus · · Score: 1

      Haha, my bad.

      I've been catting ssh public keys >> into authorized_keys a lot lately..

      --
      Cool! Amazing Toys.
    14. Re:Someone should be fired! by VeNoM0619 · · Score: 1

      Someone should be fired!
      I thought such attacks were a thing of the past. I am disappointed. But on a serious note,

      Notice emphasis. Detect the sarcasm. Calm thyself!

      --
      Disclaimer: I am not god.
      We may not be created equal
      But we can be treated equal.
    15. Re:Someone should be fired! by marka63 · · Score: 1

      The best you can do is make sure your ISP is deploying BCP 38 measure to prevent them being a source of these spoofed packets.

      If you are a ISP you should be including BCP 38 deployment as a pre-condition for
      peering.

      If you are a transit provider you should be make BCP 38 deployment a pre-condition to accepting traffic.

      It's not like this is new problem.

  9. Re:Oops... by troll8901 · · Score: 2, Funny

    So that's you, making my 40Gb/s connection slow!

    Now I'm shelling out for 14Tb/s. Money don't grow on trees, you know.

  10. Tuesday by Ice+Wewe · · Score: 1

    This happened Tuesday and Network Solutions has restored service, therefore, this story is moot.

    http://blog.networksolutions.com/2009/potential-latency-on-network-solutions-dns/

  11. Downright Gibsonian by thered2001 · · Score: 2, Interesting

    Man, am I getting old. This shit used to be relegated to print sci-fi, now its reported like the weather. The first thing I'm thinking is "will this prevent me from working from home on Monday?"

    I'll do to the only thing I can think of: I'll invoke a friendly spirit: "Wintermute! Help us!"

    --

    If your only tool is a hammer, every problem becomes a nail.

    1. Re:Downright Gibsonian by franl · · Score: 1

      Hmm. Was Wintermute truly friendly? Time to re-read that book.

    2. Re:Downright Gibsonian by zappepcs · · Score: 5, Insightful

      You might be getting old, but reporting malicious attacks like the weather is a good thing. Some will get tired of it, but the good thing is that perhaps the average joe public user will become aware of how vulnerable their on-line experience and computer are. Fighting DDoS attacks has been done successfully, but it takes a lot of work, and a lot of hardware. There are a couple of stories on the Internet about such.

      The most recent botnet reports show that 100s of millions of PCs are infected with via a MS vulnerability that was fixed with a patch last year.

      We need to see the awareness level increased, and some serious attention to detail on the patch/upgrade cycles.

      --
      Support NYCountryLawyer RIAA vs People
    3. Re:Downright Gibsonian by sashang · · Score: 1

      You're not old - your slashdot id is greater than 1 000 000

    4. Re:Downright Gibsonian by thered2001 · · Score: 1

      You're right, he wasn't friendly. I seem to recall that, like HAL9000, he was mostly doing what he was programmed to do.

      --

      If your only tool is a hammer, every problem becomes a nail.

    5. Re:Downright Gibsonian by thered2001 · · Score: 1, Informative

      If I had mod points right now, I'd boost your reply beyond mine. My quip elicited your insightful reply...hopefully, it gets the attention it deserves.

      --

      If your only tool is a hammer, every problem becomes a nail.

    6. Re:Downright Gibsonian by thered2001 · · Score: 1

      True w/r/t /. but I'm over 22.6 mega-minutes in age. THAT probably makes me older than many here.

      --

      If your only tool is a hammer, every problem becomes a nail.

    7. Re:Downright Gibsonian by Culture20 · · Score: 1

      The first thing I'm thinking is "will this prevent me from working from home on Monday?"

      And if it did, would physically being at work be any better? Some people's jobs are heavily dependent on the internet, not work's intranet.

    8. Re:Downright Gibsonian by Cybersonic · · Score: 1

      this thread makes me feel ooooooold

      --
      Cybie! aka Ralph Bonnell
    9. Re:Downright Gibsonian by zappepcs · · Score: 1

      It's just a thought, but if schools can start teaching geeks/nerds how to be social, teaching others how to manage their pc is probably not far off in the future.

      --
      Support NYCountryLawyer RIAA vs People
  12. That would explain the surge in DDoS spray packets by Swordfish · · Score: 3, Interesting

    That would help to explain the surge in this kind of thing in the last few days.

    15:07:13.666770 IP 63.217.28.226.17498 > 158.64.65.65.53: 36407+ NS? . (17)
    15:07:13.750783 IP 63.217.28.226.61231 > 158.64.65.65.53: 46118+ NS? . (17)
    15:07:13.831834 IP 63.217.28.226.44626 > 158.64.65.66.53: 51544+ NS? . (17)

    Except that that source IP address doesn't look like a Network Solutions address to me.

    Is it possible that there is a DDoS technique where the source IP addresses on DNS packets to 3rd party DNS servers are spoofed so as to generate the appearance of an attack from a different source? I guess that's what they're saying. But it doesn't seem to multiply the power of an attack much. They just get 17 bytes of DNS response from each 17 byte request.

    It's all a bit confusing really....

  13. Making available legal doctrine means MS must pay! by Swordfish · · Score: 1, Flamebait

    Now correct me if I'm wrong, but if the mafiaa's legal theory on "making available" is right, doesn't that mean that any company which makes available software which is easy to turn into a DoS zombie should be held liable. And the people who let their computers become zombies should be held liable for making their machines available to become zombies.

    Not only that, those made-available computers actually _are_ exploited for evil acts.

    So aren't the purveyors of dodgy software liable for damage caused by DDoS attacks?

    Blaming the DDoS controlling people for the attacks is a bit like blaming the downloaders of music/videos for downloading copyright stuff instead of blaming the makers-available.

    Just a thought....

  14. Re:That would explain the surge in DDoS spray pack by epiphani · · Score: 5, Interesting

    The problem seems to kick in for DNS servers that arent rejecting the queries. Someone is channeling ye 'ole smurfing methods.

    They're requesting a list of all DNS root servers. If the server don't reject the query, a 17 byte query becomes a 50k response (or something like that) to the spoofed address.

    --
    .
  15. Drudge Report by DigiShaman · · Score: 2, Interesting

    That would explain why access to the drudgereport page has been off and on. DNS failure would do it.

    Administrative Contact :
                  Drudge, Matt
                  rg3kn2zw89n@networksolutionsprivateregistration.com
                  ATTN: DRUDGEREPORT.COM
                  c/o Network Solutions
                  P.O. Box 447
                  Herndon, VA 20172-0447
                  Phone: 570-708-8780

                  Technical Contact :
                  Drudge, Matt
                  rg3kn2zw89n@networksolutionsprivateregistration.com
                  ATTN: DRUDGEREPORT.COM
                  c/o Network Solutions
                  P.O. Box 447
                  Herndon, VA 20172-0447
                  Phone: 570-708-8780

                  Record expires on 15-Feb-2013
                  Record created on 14-Feb-1997
                  Database last updated on 29-Feb-2008

                  Domain servers in listed order: Manage DNS

                  NS6.HA-HOSTING.COM 64.73.222.3
                  NS1.HA-HOSTING.COM 66.28.209.220
                  NS4.HA-HOSTING.COM 8.10.64.46
                  NS2.HA-HOSTING.COM 8.10.64.38
                  NS5.HA-HOSTING.COM 66.234.135.94
                  NS3.HA-HOSTING.COM 66.28.209.221

    --
    Life is not for the lazy.
  16. Re:Making available legal doctrine means MS must p by eggman9713 · · Score: 1

    Except that in many jurisdictions the criminal activity of others cuts off liability. IE if Microsoft provides software, and someone else exploits it, the criminal activity of the third party cuts off liability to Microsoft.

  17. Fire! Fire! Fire!...OMG! Mushroom clouds!! by rts008 · · Score: 1

    Well, in the firearms manufacturing industry it is called Proof Testing, and is a good thing.

    But you might still want to don some protective gear, maybe find a fallout shelter, etc....*alarms sound* Warning! Servers going critical! Eject the warp core immediately! Warning! Servers g

    --
    Down With Slashdot BETA!!! I've been around the corner and seen the oliphant; you can only abuse me from your perspecti
  18. Neuromancer by rdwulfe · · Score: 1

    *spoiler alert* - but if you haven't read these books yet, you're either very young, or not a geek. Wintermute was trying to overcome his programming, which was keeping him and Neuromancer separate. I believe. It's been a long while since I read the books.

  19. Re:That would explain the surge in DDoS spray pack by nairnr · · Score: 1
    I saw a whole bunch of requests that my DNS server was rejecting. I think for your computer to have been part of the problem it needed to allow recursive DNS queries for the public. I was watching my logs and banned the IP's when I saw them.

    I was getting a lot of messages that looked like named[2476]: client xx.xx.xx.xx#22707: view external: query (cache) './NS/IN' denied

  20. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  21. Re:Making available legal doctrine means MS must p by bigsteve@dstc · · Score: 1
    Now correct me if I'm wrong ...

    OK.

    The RIAA's legal theory is in the context of copyrights and illegal copying. It simply does not apply here. Microsoft own the copyright on their stuff, so they are free to make it available.

  22. I wonder if this is related.. by Anonymous Coward · · Score: 2, Interesting

    I wonder if this is related to this http://isc.sans.org/diary.html?storyid=5713

  23. Re:Red headlines? by troll8901 · · Score: 1

    CmdrTaco should put in blaring sirens (or baring sirens) as well.

  24. Re:Making available legal doctrine means MS must p by evanbd · · Score: 1

    First, said doctrine is not correct even in the intended context.

    Second, just because you can use some of the same words does not mean that your armchair legal theory has anything to do with their legal theory. That said, it is equally correct (which is a nice way of saying wrong).

  25. This is not too hard to solve. by John+Sokol · · Score: 2, Interesting

    http://www.dnull.com/dos/DOS-Block.htm

    **sigh**

    --
    I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
    1. Re:This is not too hard to solve. by John+Sokol · · Score: 1

      So what, it's 2001. Does that somehow make it less valid? If your right your right, 10 minutes or 10 years doesn't change that.

      It's my article, and it will work, even it they choose to keep letting things like this happen.

      At some point we will have to implement something, but the longer they put it off, the harder it will be to fix later.

      --
      I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
    2. Re:This is not too hard to solve. by John+Sokol · · Score: 1

      Great stuff.
      But you prove my point even further then.
        Didn't you...
        So it's even more embarrassing that there are RFC already out there to solve this and they choose not to implement this.

      I don't claim to be the first to figure this out.
      I didn't even bother to research it, just put my idea out there for what ever it's worth back in 2001.

      --
      I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
  26. Re:The Beginning? by Rayban · · Score: 4, Funny

    Damn whoever first started spelling that as "Cornfucker". I keep seeing that now - just waiting to say it accidentally.

    --
    æeee!
  27. Re:Oops... by cheekyboy · · Score: 1

    money is printed infinitely by the federal reserve, because its digital, its 'free', trees cost more ;_)

    --
    Liberty freedom are no1, not dicks in suits.
  28. Re:That would explain the surge in DDoS spray pack by Spit · · Score: 2, Informative

    Don't block the requests, the requester IP is spoofed so that DNS servers which respond with root hints forward them to the innocent party, causing DoS. Vlocking the IP just blocks the innocent party's DNS servers. Just make sure that you don't respond external recusive queries.

    --
    POKE 36879,8
  29. Re:Red headlines? by poopdeville · · Score: 1

    You can simulate a blink tag with simple JavaScript. Something like

    function blink (on, off) {
          i = 0;
        while (i < 99999) {
            i++;
        }
        on.style("display:none");
        off.style("display:on");
        blink (off, on);
    }

    Note the tail recursion, for speed.

    --
    After all, I am strangely colored.
  30. Re:That would explain the surge in DDoS spray pack by Glendale2x · · Score: 1

    It's a spoof. The attacker sends requests to lots of different nameservers with a spoofed return address. Those servers respond to that address as normal. The target suddenly gets a lot of DNS traffic from all over the place. Instant amplification attack.

    (Gross simplification, but it's late and someone else can explain the details.)

    --
    this is my sig
  31. A teen geek reminiscence by Fantastic+Lad · · Score: 1

    I was just thinking yesterday about how the humble virus had grown. I was wowing over the Amiga 500 my friend's older brother had bought (with his very own money!), when said older brother caught us creeping around in his room.

    But instead of tossing us out like the brats we were, he came in and fired it up to show it off to us in a casual display of older-geek coolness I was deeply impressed by. The guy was hard core, heading off to study at MIT in a few months time. The best I'd ever done for geek-cred was to assemble an old Apple II by soldering where the mother board said to soldier without really knowing much about the why or wherefore, so this guy, who had built his own memory circuits on breadboards just to see if he could. . , he seemed like Batman to me. Damn, he was so cool, he even had a *girlfriend* during high school.

    So he hung out with us for a while and brought us up to speed on all the coolest things going down in the world of geek lore, one item of which was that there was such a thing as the, "Computer Virus".

    The concept seemed utterly sci-fi to me, and it caught my imagination like a torch. I remember wandering home with a multiplying flow-chart of possibilities developing in my mind, all leading to. . , well today actually.

    The funny thing is that whenever the 'future' does happen to show up, it always seems to feel suspiciously like another bland variation of 'today', --and it never contains flying cars or Harrison Ford running around looking wounded and armed and trench-coaty. For some reason, no matter how I envision the future, it always involves imagery from Blade Runner. Either that, or the Happy Ending from one of those Sid Meyer games.

    I guess we're lucky both ways.

    Cheers!

    -FL

  32. Re:That would explain the surge in DDoS spray pack by Lennie · · Score: 1

    It's a spoof but not the problem network solutions has/had

    --
    New things are always on the horizon
  33. Re:Making available legal doctrine means MS must p by jabithew · · Score: 2, Interesting

    I think it is still an interesting question to consider if there is any liability to Microsoft for damage caused by a virus hosted on their OS.

    My instinct is that there isn't, as it is perfectly possible to run Windows virus-free, with varying levels of difficulty. Also, in this case Microsoft made a patch available, so the OS as provided by Microsoft is immune to the attack.

    --
    All intents and purposes. Not intensive purposes.
  34. Re:That would explain the surge in DDoS spray pack by Onymous+Coward · · Score: 2, Interesting

    It's a reflection attack. Send a small query that requires a bigger answer to a bunch of nameservers. Spoof the source address for the query.

    Here's what I'm seeing of this attack.

  35. netsol != isprime by Anonymous Coward · · Score: 1, Interesting

    what the hell does this have to do with netsol? the traffic from this ddos is originating from isprime and something called "beyond the network inc", both american companies.

    1. Re:netsol != isprime by viscous · · Score: 1

      Indeed, this doesn't seem to have any connection to the Network Solutions problem. It looks like another DDoS attack that just happens to be taking place at the same time. There may be some devious connection between the two, but nobody seems to be making that case.

      (And of course nothing is "originating from isprime" -- those source addresses are forged.)

  36. Re:That would explain the surge in DDoS spray pack by Onymous+Coward · · Score: 1

    a 17 byte query becomes a 50k response (or something like that)

    I haven't tried to figure out the exact numbers, but my tcpdump files of a root NS query and its response have been about 100 and 300 bytes respectively.

    Oh, here: dig reports "MSG SIZE rcvd: 300".

    Still, a DNS amplification attack. (Not a smurf attack, though that's another reflection/amplifcation attack, but it's specifically with pings.)

  37. Citation needed? by Eunuchswear · · Score: 1

    Slasdot sez:

    CircleID is reporting a large-scale DDoS attack affecting all of Network Solutions' name servers

    And at http://www.circleid.com/posts/20090123_network_solutions_down_ddos_attack/ we find:

    Other sources: UPDATED Jan 23, 2009 7:26 PM PST
    [...]
    Network Solutions Under Large-Scale DDoS Attack, Jan.23.2009

    ...argh! non-halting loop detected! They've ddos'd the web!

    --
    Watch this Heartland Institute video
  38. Re:Red headlines? by KasperMeerts · · Score: 1

    Note the tail recursion, for speed.

    A tail recursion is supposed to stop sometime, this is just a (small) memory leak.

    --
    As long as there are slaughterhouses, there will be battlefields.
  39. Re:That would explain the surge in DDoS spray pack by Cally · · Score: 2, Informative

    Exactly. The attacker spoofs UDP DNS queries and sends them to third-party DNS servers. They respond to the spoofed, victim's nameservers. The idea is that the attacker sends a small packet which induces a large response ('amplification') from the third party to the victim.

    Incidentally when did Network Solutions change their name to "IsPrime"?

    --
    "None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
  40. Obligatory quote by Torodung · · Score: 1

    A communications disruption can mean only one thing...

    Keep your eyes peeled for those Trade Federation landers.

    (Yeah, just kidding. Here's the real page.)

    --
    Toro

  41. Just kidding, here's the REAL link by Torodung · · Score: 1

    http://starwars.wikia.com/wiki/C-9979_landing_craft

    Bet you thought I should turn in my geek card, eh?

    --
    Toro }B^>

  42. Good by nurb432 · · Score: 2, Insightful

    Netsol sux anyway.

    Anyone else notice how they send out notices with the FROM: address forged as the TO address? Most people would get sued for fraud.

    --
    ---- Booth was a patriot ----
    1. Re:Good by mattr · · Score: 2, Interesting

      I moved a domain from netsol in January and let me tell you it was like pulling teeth. The non-existent control panel button, the "security" which secures them against you, the sales rep on the phone who passes you on, each person initiating a new sales pitch... only got them to move at all by threatening to report them. I used them for 10 years and knew they were tough to like but never again. FWIW Mom uses GoDaddy, and for hosting I like linode.com or anybody else.

    2. Re:Good by nurb432 · · Score: 1

      I moved away from them 10 years ago and it was a nightmare then too.

      I almost lost my domain in the shuffle. Legal threats were required even then. ( they were a virtual monopoly and had you over a barrel )

      --
      ---- Booth was a patriot ----
  43. Re:Ha Ha. by shentino · · Score: 1

    I doubt it.

    GoDaddy was the one that caved to the kentucky gambling site seizure while NS had balls enough to say no.

  44. Look for DNS/SSL/MITM attacks about now... by DamnStupidElf · · Score: 3, Interesting

    The only obvious reason to DDoS a bunch of DNS servers is if you're going to be doing some cache poisoning and mounting a massive MITM attack, and if you're lucky you recently obtained a trusted intermediate CA via an MD5 collision attack on a lousy root CA like RapidSSL.

    Has anyone bothered to petition Mozilla to remove all the offending root CAs with the weakness shown in MD5 considered harmful today?

  45. Comment removed by account_deleted · · Score: 1

    Comment removed based on user account deletion

  46. Re:Red headlines? by inotocracy · · Score: 1

    Um.. never heard of setTimeout()? Fail.

  47. That explains it by Jay+L · · Score: 1

    I'd noticed that all my DNS queries for non-existent domains were actually returning NXDOMAIN, instead of an advertisement...

  48. Re:Making available legal doctrine means MS must p by shentino · · Score: 1

    MS isn't going to be liable until they are, either by law or contract, obliged to third parties not to make an infectable OS.

    I'd like resilience to viruses be a required safety feature, much like guards are in heavy machinery, and I would also like lack of said resilience be a case of product liability.

    Given how deep MS probably is in the pockets of congressmen, I doubt they'll get any such standard laid upon them.

  49. Re:Red headlines? by Lord+Flipper · · Score: 1

    function blink (on, off) {
          i = 0;
        while (i < 99999) {
            i++;
        }
        on.style("display:none");
        off.style("display:on");
        blink (off, on);
    }

    Or this in CSS:

    selector.class or ID {text-decoration: blink;}

    and call a script on the ie-only css for out-of-it browsers. It'll be nice, someday, to be able to jettison the bulky js and just use the css.

  50. Re:Red headlines? by poopdeville · · Score: 1

    Context! We were complaining about gaudy and intrusive JavaScript -- that is, slashdot -- so I wrote some.

    --
    After all, I am strangely colored.
  51. Re:That would explain the surge in DDoS spray pack by marka63 · · Score: 1

    Even with EDNS 4k is the largest response current nameservers will emit.
    None of this 50k garbage.

    The response to this query will be = 512 bytes as they use plain DNS.
    With EDNS it would be a little larger but not much.