Slashdot Mirror
Network Solutions Under Large-Scale DDoS Attack
netizen writes "CircleID is reporting a large-scale DDoS attack affecting all of Network Solutions' name servers for the past 48 hours, potentially affecting millions of websites and emails around the world hosting their domain names on the company's servers. The NANOG mailing list indicates that it is due to a very large-scale UDP/53 DDoS which Network Solutions has also confirmed: 'There is a spike in DNS query volumes that is causing latency for the delay in web sites resolving. This is a result of a DDOS attack. We are taking measures to mitigate the attack and speed up queries.""
Does Network Solutions have any network solutions?
Rebooted the DNS server today cause things seemed funny ... maybe this is what it really was.
Nice we can link to something in their domain to further add to the DNS traffic! Maybe someone could find a link to download some huge file from their servers, too!
I don't know, but it works for me.
Subscribe and you'll see them all the time
Negative moral value of force outweighs the positive value of good intentions.
Here is a update that we posted on the Network Solutions Blog (http://cli.gs/GEWSs0) : DNS queries for web sites should be responding normally. Thank you all for your understanding. As always, we will continue to work to take measures to prevent these and other types of technical issues caused by third parties that may impact our customers. Thanks, ShashiB
Social Media Swami | Network Solutions | http://blog.networksolutions.com
Actually I did change the forwarders and restarted the service, no reboot, just a bad description.
A perfect opportunity to use that normally B.S. excuse: "Why, no, I didn't get your email. Must've been because of that DDoS attack on the name servers."
So that's you, making my 40Gb/s connection slow!
Now I'm shelling out for 14Tb/s. Money don't grow on trees, you know.
I've heard that unplugging the network cable works OK.
Faster! Faster! Faster would be better!
you can't prevent them. they come from legit clients that have been infected with a virus. you can block the traffic by dropping traffic that matches the attach pattern, that's about it.
If you mod me down, I will become more powerful than you can imagine....
Do you even know what a DDoS attack is?
If you did, you'd realize you can't both operate a service online, and be immune. The two things are mutually exclusive.
The best you can do is slap the attack down when you see one happening. Even that isn't exactly easy. Banning a few million IP addresses tends to be a problem all by itself.
Man, am I getting old. This shit used to be relegated to print sci-fi, now its reported like the weather. The first thing I'm thinking is "will this prevent me from working from home on Monday?"
I'll do to the only thing I can think of: I'll invoke a friendly spirit: "Wintermute! Help us!"
If your only tool is a hammer, every problem becomes a nail.
That would help to explain the surge in this kind of thing in the last few days.
15:07:13.666770 IP 63.217.28.226.17498 > 158.64.65.65.53: 36407+ NS? . (17)
15:07:13.750783 IP 63.217.28.226.61231 > 158.64.65.65.53: 46118+ NS? . (17)
15:07:13.831834 IP 63.217.28.226.44626 > 158.64.65.66.53: 51544+ NS? . (17)
Except that that source IP address doesn't look like a Network Solutions address to me.
Is it possible that there is a DDoS technique where the source IP addresses on DNS packets to 3rd party DNS servers are spoofed so as to generate the appearance of an attack from a different source? I guess that's what they're saying. But it doesn't seem to multiply the power of an attack much. They just get 17 bytes of DNS response from each 17 byte request.
It's all a bit confusing really....
The problem seems to kick in for DNS servers that arent rejecting the queries. Someone is channeling ye 'ole smurfing methods.
They're requesting a list of all DNS root servers. If the server don't reject the query, a 17 byte query becomes a 50k response (or something like that) to the spoofed address.
.
That would explain why access to the drudgereport page has been off and on. DNS failure would do it.
Administrative Contact :
Drudge, Matt
rg3kn2zw89n@networksolutionsprivateregistration.com
ATTN: DRUDGEREPORT.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA 20172-0447
Phone: 570-708-8780
Technical Contact :
Drudge, Matt
rg3kn2zw89n@networksolutionsprivateregistration.com
ATTN: DRUDGEREPORT.COM
c/o Network Solutions
P.O. Box 447
Herndon, VA 20172-0447
Phone: 570-708-8780
Record expires on 15-Feb-2013
Record created on 14-Feb-1997
Database last updated on 29-Feb-2008
Domain servers in listed order: Manage DNS
NS6.HA-HOSTING.COM 64.73.222.3
NS1.HA-HOSTING.COM 66.28.209.220
NS4.HA-HOSTING.COM 8.10.64.46
NS2.HA-HOSTING.COM 8.10.64.38
NS5.HA-HOSTING.COM 66.234.135.94
NS3.HA-HOSTING.COM 66.28.209.221
Life is not for the lazy.
Easy:
cat "216.34.181.45 slashdot.org" >>
Any other questions?
Cool! Amazing Toys.
I wonder if this is related to this http://isc.sans.org/diary.html?storyid=5713
...and so ends the era of "useless use of cat"; now begins the era of "completely nonsensical attempt to use cat".
http://www.dnull.com/dos/DOS-Block.htm
**sigh**
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
Damn whoever first started spelling that as "Cornfucker". I keep seeing that now - just waiting to say it accidentally.
æeee!
Don't block the requests, the requester IP is spoofed so that DNS servers which respond with root hints forward them to the innocent party, causing DoS. Vlocking the IP just blocks the innocent party's DNS servers. Just make sure that you don't respond external recusive queries.
POKE 36879,8
Not quite - you're thinking of older versions. Modern versions of Peakflow are teamed with TMS (Threat Management System), which allow you to mitigate DDoS attacks.
From their website, "Surgical Mitigation Arbor Peakflow SP TMS enables you to automatically detect and surgically remove only the attack traffic while maintaining legitimate business traffic â" thereby ensuring the highest level of customer satisfaction."
http://www.arbornetworks.com/en/threat-management-system.html
- passion
I think it is still an interesting question to consider if there is any liability to Microsoft for damage caused by a virus hosted on their OS.
My instinct is that there isn't, as it is perfectly possible to run Windows virus-free, with varying levels of difficulty. Also, in this case Microsoft made a patch available, so the OS as provided by Microsoft is immune to the attack.
All intents and purposes. Not intensive purposes.
It's a reflection attack. Send a small query that requires a bigger answer to a bunch of nameservers. Spoof the source address for the query.
Here's what I'm seeing of this attack.
Exactly. The attacker spoofs UDP DNS queries and sends them to third-party DNS servers. They respond to the spoofed, victim's nameservers. The idea is that the attacker sends a small packet which induces a large response ('amplification') from the third party to the victim.
Incidentally when did Network Solutions change their name to "IsPrime"?
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
Netsol sux anyway.
Anyone else notice how they send out notices with the FROM: address forged as the TO address? Most people would get sued for fraud.
---- Booth was a patriot ----
The only obvious reason to DDoS a bunch of DNS servers is if you're going to be doing some cache poisoning and mounting a massive MITM attack, and if you're lucky you recently obtained a trusted intermediate CA via an MD5 collision attack on a lousy root CA like RapidSSL.
Has anyone bothered to petition Mozilla to remove all the offending root CAs with the weakness shown in MD5 considered harmful today?