4

I'm somewhat confused as to the technical details of the Oct. 21 DDoS. Dyn is a company, which according to wikipedia

is an Internet performance management company, offering products to monitor, control, and optimize online infrastructure, and also domain registration services and email products.

I'm assuming they own a popular DNS server which was attacked? I've heard two claims in the news which confuse me

  1. certain geographic areas were affected, namely western US and western Europe
  2. certain sites were affected, such as Twitter.

How could taking down a DNS server affect particular locations? Is the idea that people tend to use DNS servers geographically closest to them so it would be logical that those physically closest to the servers would be the most affected?

How could certain sites (such as Twitter) be more affected than others?

Is this likely the work of a state sponsored actor and if so, what's the point in pursuing them? It's not like North Korea's going to allow the FBI to extradite someone who attacked the US. Seriously though, are there any international bodies that could prosecute "crimes" (if it's considered one) like this?

2

The largest Internet sites, Content Distribution Networks (CDN's), search engines, and companies that do things like streaming video leverage geographically load-balanced DNS which means when you look for their DNS servers from different parts of the world or from different ISP's you get different results. The following are two tests run against github.com from different parts of the US. In the example below you might notice that an attack against dynect.com will affect the Dallas users but not the Seattle ones. This geographically load-balanced DNS is why it was affecting some people and not others. The fact that many companies use different DNS providers is why it only affected some companies.

dig -t NS github.com (from Dallas)

; <<>> DiG 9.8.1-P1 <<>> -t NS github.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49558
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;github.com.            IN  NS

;; ANSWER SECTION:
github.com.     25147   IN  NS  ns4.p16.dynect.net.
github.com.     25147   IN  NS  ns1.p16.dynect.net.
github.com.     25147   IN  NS  ns2.p16.dynect.net.
github.com.     25147   IN  NS  ns3.p16.dynect.net.

;; Query time: 2 msec
;; SERVER: 173.203.4.8#53(173.203.4.8)
;; WHEN: Sat Oct 22 06:24:33 2016
;; MSG SIZE  rcvd: 114

dig -t NS github.com (from Seattle)

; <<>> DiG 9.8.3-P1 <<>> -t NS github.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47222
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;github.com.            IN  NS

;; ANSWER SECTION:
github.com.     586 IN  NS  ns-1283.awsdns-32.org.
github.com.     586 IN  NS  ns-1707.awsdns-21.co.uk.
github.com.     586 IN  NS  ns-421.awsdns-52.com.
github.com.     586 IN  NS  ns-520.awsdns-01.net.

;; Query time: 78 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Oct 21 23:24:17 2016
;; MSG SIZE  rcvd: 165

Tests run within a minute of each other (clock offset because one was a server and the other is from my laptop).

  • Seems you have a thorough answer but I have trouble following it. How do you use the term "geographically load-balanced DNS"? So if a client queries DNS 1.2.3.4 it is redirected to the one physically closest to it, but if this one is down it cannot use another? I'm confused because usually "load-balanced" means to me, that if x is unavailable you can use y, so I would think this would have the opposite affect of what you describe? – Celeritas Oct 22 '16 at 6:44
  • Person A queries company.com and gets 1.2.3.4. Person B queries company.com and gets 5.6.7.8. The Load-balancing is of the public's requests for DNS resolution. They are effectively balancing the global load of requests and sending each person responses to servers closest to where they made the request. This can also be used to send different customers to different servers possibly in different languages or with different news items. – Trey Blalock Oct 22 '16 at 6:46
  • I mean google's DNS is 8.8.8.8 but I'm sure there's more than one physical server that responds to that IP address. I guess I don't know exactly how load balancing works with respect to DNS? – Celeritas Oct 22 '16 at 6:46
  • "Person A queries company.com and gets 1.2.3.4. Person B queries company.com and gets 5.6.7.8" ok so 1.2.3.4 and 5.6.7.8 both belong to company.com and the DNS server knows this and preforms load balancing? – Celeritas Oct 22 '16 at 6:48
  • 1
    But if the DNS server goes down then neither 1.2.3.4 or 5.6.7.8 are accessible so how could load balancing be responsible for only some geographical locations being affected? – Celeritas Oct 22 '16 at 6:51
0

As well as difficulty in contacting the website directly, as addressed in the other answer, DNS issues can and do cause websites to not function properly. Nearly all websites make lots of calls to external services and APIs, and if they can't resolve the host names for those services than the calls will fail, with varying and unpredictable effects on the website. And they will make even more internal calls to services, and may depend on external DNS resolution for those calls as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.