Hackers say Friday's massive DDoS attacks were just a dry run

First off, putting a negative spin to competition already tells me you have either a very narrow view or see something I dont. When iojs forked from nodejs, it was a competitor. Linux is a competitive landscape. Browsers are a competitive landscape. The idea that cooperation and consistancy leads to the best possible product is only as accurate as who is trusted to be the leader. There are some pretty dumb leaders out there but convincing enough to be trusted with millions of dollars.

Second off, the government didnt force all devices to be vulnerable. "Agile" development practices which we trust so much are what led us here. Build first, worry about security later. The fact that a persons information is valuable to the creator of these devices and they provide a direct gateway so they could be accessed by a third party. And the fact that consumers ignore any possible issues that may arise because they see the benefits.

You talk about logic, well logically we wouldnt have computers or any of this if it wasnt for competition abd the desire to evolve. And logically trust and freedom allowed these vulnerabilities to ho unchecked because the software is not open source and companies are free to do whatever they want since its up to the consumer to judge whether its worth it or not.

I understand why you want to make this political and pro-love because arguably any problem can be answered by pro-love. But logically, you should think before you dpeak and attempt to frame your argument with a consistant locigal tree than start blaring out hatred for the capitalist system

What do these attacks have to do with the government? My current understanding is that it was an attack against a private organization

> An important first step is to put the military dog back on the chain and show it the place where it belongs to and never ever allow it to infiltrate politics.

You seem to be under the impression that military largely controls the politics and that's why there are wars. It's not true, at least not in western democracies. Most wars start when they are popular (and they are made popular by career politicians and not military) and end very soon after becoming unpopular (and the military can't do anything about it).

> Military solutions must only be the last step of self-defense that we need to use when all politics failed.

That's a nice thing to say but politics fails all the time. In fact, politics fails way more often than military is used - in most cases, the solution for politics failing is just sigh and wait until maybe something changes, military is used in rare occasion where it's politically feasible and seems to be achievable by military.

Can anyone comment on the best way to run multiple DNS services?

Is this as simple as setting up the same records on multiple providers and updating your nameservers to point to the different providers? Or is there more involved?

Are there any providers which will replicate records from your 'master' provider, or is this going to be manual?

> - Get multiple DNS services now. Not just two. Get four or five, some of which are not widely used.

Why is this not a default feature by DNS providers themselves?

I always assumed they act as slave copies for each other to avoid this kind of situations

Also, make yourself a personal emergency hosts file for your favorite websites.

> Ycombinator.com, why do you have a TTL of 12 seconds?

You either meant to say 60 seconds, or forgot to factor your local caching DNS resolver in. Here:

  $ dig +short soa ycombinator.com
  ns-225.awsdns-28.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400

  $ dig a ycombinator.com @ns-225.awsdns-28.com. | grep -A3 'ANSWER SECTION'
  ;; ANSWER SECTION:
  ycombinator.com.        60      IN      A       54.240.184.14
  ycombinator.com.        60      IN      A       54.240.184.154
  ycombinator.com.        60      IN      A       54.240.184.206

That said, 60 seconds is still ridiculously low.

Also:

- Put up a caching DNS server on your local network to keep your regular sites functioning.

Sorry to chime in late, a day after this comment was added.

If you set a long DNS TTL, then you will not be able to move your IP addresses quick enough. In the DDoS world, you may need to nullroute an HTTP server IP. If you do that, you assume you can point the DNS to another, not-nulled IP. For this reason, keeping the DNS TTL to low values will make you more resilient.

Multiple DNS providers is probably a good advice, although hard to do in practice. The api's of different vendors don't always match. (cname flattening? geo-routing?). Also a real big attack will just likely take down all your providers. Using multiple providers may well _decrease_ the stability of the internet at large.

DDoS against DNS is not trivial problem. As sad as it may be, I'd say we must just assume DNS infrastructure in the world works. If it stops, then, many users will be affected.

Makes sense to me.

Back in the day, the Internet was far simpler, with far less bullshit. If your IP was spewing crap, you would hear about it. And you either resolved the problem, or got null-routed.

The Internet is far^N larger and more complex, for sure. But accountability still has a place, I think.

I wonder if Dyn will at least release a heat map of source IPs.

Or Dyn and the like should build a system to throttle requests from a given IP. Whitelist trusted IPs that REQUIRE high volume of requests.

Most users are on dynamic IPs. So you'd probably be blocking/nagging the wrong person

Or, ISPs could simply block all service to offending IP addresses. The customer would see a notice: "The following IP address delivered N Gb of traffic over our network as part of a malicious DDOS attack. Please patch or isolate the offending device and contact customer service at 123-456-7890 to restore service."

I guess that wouldn't make your customers super happy, but it would probably be effective.

Isn't this what CISPA was trying to provide a legal framework for?

This is an attack over UDP. The source address is likely spoofed. Simply blocking an IP will do nothing but banning somebody not related to the attack at all.

I think there's might be a significant legal issue to an ISP patching customers devices. Also a spoofed IP renders the source meaningless.

">THEN google, Facebook, Twitter, etc (major web properties) use this list to notify any of its users that one or more of their devices have been compromised and point them to a how to guide for securing it."

I am not sure I want FB and Google policing the internet. They have enough power as it is. This would set a bad precedent.

Or just brick all the IoT devices. It's easier, faster, more effective. ;)

I was just saying to a friend yesterday that this would be a great policy. I think it would go a long way.

But the problem remains that these devices, more often than not just don't get updated. So in a year or two, there will probably be a handful of exploitable issues that won't ever get patched...

If routers weren't such a crapshot security wise as well, they'd be a great integration point.

Most better routers nowadays can already isolate devices from the internet/whitelist specific domains (family filter functions) and offer VPNs from the outside. From a technology perspective that's most of the pieces you need. Make a better UPnP implementation with user confirmation, make it easier to configure and everybody can get their devices nicely isolated-but-accessible.

Most modem/routers that ISPs give you come with a password that is defaulted to something random - different for every device - and a sticker with that password somewhere on the physical device.

That seems like the best solution. Now we just need to enforce that as a standard with internet connected devices.

Or rather just block problematic IPs and make the user secure their systems or noth have access.

Do we have any idea of what proportion of devices are "owned" via default or unset passwords, as opposed to actual exploits?

Or ship every new device with a different randomly generated 10+ character password and writing it on the device's label just like the MAC address. I agree you would need physical access to the device to gain access to it but you can always change the password to avoid this. There are vendors that already do this with the WiFi key.

This would be a nice improvement, but as others point out, more flaws will exist and be exploited.

Really this is about incentives: manufactures and users have little incentive to worry about security if the losers are third-party the targets of a DDOS.

Things will only improve when there is liability: either the manufacturers or the users get fined when their stuff becomes an attack vector. Fining users will probably never be politically possible, but I suspect it would be the better option.

There's also a subreddit of the same name that has some good articles from time to time.

Or a worm that patches them, removes malware, changes the credentials, or something like that.

Too late. The attack payload apparently turns off the Telnet service to prevent other botnets from taking over the device.

My experience from talking with non-techies suggests that they'll never understand the problem is the lack of security in their devices & network. All they do is act victim and get enraged about hackers. The thought that they should demand security from the companies who sold them the vulnerable devices doesn't cross their mind, and if try to sell them such an idea, they will protest and call for justice on the principle that it is the hackers who are being criminal and it's not the victim's or his devices' responsibility to keep themselves safe. Just as they don't expect to have to live in a bunker with inpenetrable locks to stay reasonably safe from burglary.

Not at all the case with IoT. See Bruce Schneier's recent article on the matter, where he makes the case that government regulation is the only feasible remedy at this point, as "The market can't fix this because neither the buyer nor the seller cares." [1].

[1] https://www.schneier.com/blog/archives/2016/10/security_econ...

I think its just the good old 1990s scenario repeating itself, only this time with IoT, rather than usual IT.

First, a mad rush towards the IoT where every startup and their dog wants to setup their business on IoT. Then comes fear as the hackers try to exploit every hole in IoT devices. And finally, once people realize the importance of keeping with the software upgrades, the market will settle somewhere in between.

This is trolling

They say they'll target Russia next.

I guess we'll know soon.

I wouldn't say forever. Technologies become outdated and people upgrade to new, more powerful IoT devices with default passwords.

UPNP

Because the whole internet would become unusable if DNS lookups cost you a dollar.

In the first place, the requests are being made by owned IoT devices. So making the requests more expensive (in time, bandwidth, or actual money) would just hurt the owners of those devices. The people operating the botnet wouldn't care, they'd just get a larger botnet.

presumably when Mirai botnet compromises them, it changes the passwords.

Ask anyone involved in rolling out IPv6 how painful it is to get every middlebox on the public Internet to route a different protocol besides the original IPv4.

What about a special set of bytes that are standardized that all IOT machines should send in every request. Some sort of IS_IOT signature. That way if there's a huge influx, all messages containing the signature could be filtered.

Whatever protocol you use, its traffic will be flowing the same pipes.

What a BS. When you target Russian government you don't test on completely unrelated infrastructure it doesn't use.

I have the same question. Countless articles explain these attacks are being carried out via IoT devices but I've seen no mention of specific brands/models. Are there worst offenders? Are common devices like Nest, Wink, etc vulnerable?

IMO it's already a bad practice to have SSH listening on a publicly accessible interface on port 22.

I recall an era where boxes came with default firewall rules to block telnet, SSH, windows shares, SMTP.

Everything looks so fake nowadays.

Perhaps this should be the source link instead of CBC.

Worth noting:

>we are in Russia

Also their website default page looks like DDoS UI.

The Mirai source is up on GitHub if anyone's considering doing this: https://github.com/0x27/linux.mirai.

Regardless of any good intentions, it'd be a pretty grey area to deploy a tool that cleaned and then protected against future attacks on a device. The exploit (well, at least the one currently drawing attention) is targeted at devices running BusyBox that are compromised over telnet with a embarrassingly small dictionary attack. If you could clean any existing instances, the protection for future exploits is simple - set a randomly generated password.

The downside is doing this (without approval) to remote devices would likely break device functionality. The majority of users/owners of these devices are likely completely unaware they have been compromised today as it has little to no effect on anything they can see. Sure, a robing hood malware could clean up this mess pretty effectively, but the little side effect of stopping devices from, you know, working is probably undesirable.

> "I think these statements are bogus. Russian government is a much smaller target than Twitter."

It's not about the size of the infrastructure, it's about the size of the political statement. Targeting larger infrastructure first appears to have been a move to demonstrate the power of their botnet.

It would be almost useless since localhost doesn't even generate outside traffic. It will only drive up the electricity consumption and heating the device. One could run a fork bomb and temporarily brick or permanently damage the device (due to overheating) or disable networking altogether.

IP space is limited. If you have a botnet already, you can scan all of IP space.

Also, a lot of them expose web interfaces that Google has already found...

The article said they would be targeting Russia.