Someone Is Trying To Take Down the Internet

[Michael Scally MD]

This Is Probably Why Half the Internet Shut Down Today [Updating]
http://gizmodo.com/this-is-probably-why-half-the-internet-shut-down-today-1788062835

Twitter, Spotify and Reddit, and a huge swath of other websites were down or screwed up this morning. This was happening as hackers unleashed a large distributed denial of service (DDoS) attack on the servers of Dyn, a major DNS host. It’s probably safe to assume that the two situations are related.

Domain Name Servers (DNS) act as the Internet’s phone book. Basically, they facilitate your request to go to a certain webpage and make sure you are taken to the right place. If the DNS provider that handles requests for Twitter is down, well, good luck getting to Twitter. Some websites are coming back for some users, but it doesn’t look like the problem is fully resolved.

...


Someone Is Learning How to Take Down the Internet
Someone Is Learning How to Take Down the Internet

Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don't know who is doing this, but it feels like a large a large nation state. China and Russia would be my first guesses.

…

Who would do this? It doesn't seem like something an activist, criminal, or researcher would do. Profiling core infrastructure is common practice in espionage and intelligence gathering. It's not normal for companies to do that. Furthermore, the size and scale of these probes—and especially their persistence—points to state actors. It feels like a nation's military cybercommand trying to calibrate its weaponry in the case of cyberwar. It reminds me of the U.S.'s Cold War program of flying high-altitude planes over the Soviet Union to force their air-defense systems to turn on, to map their capabilities.

What can we do about this? Nothing, really. We don't know where the attacks come from. The data I see suggests China, an assessment shared by the people I spoke with. On the other hand, it's possible to disguise the country of origin for these sorts of attacks. The NSA, which has more surveillance in the Internet backbone than everyone else combined, probably has a better idea, but unless the U.S. decides to make an international incident over this, we won't see any attribution.

But this is happening. And people should know.

 

[ickyrica]

I have a few customers that have been dealing with this.

New battle front as the cold war returns...

 

[flenser]

Map of the attack from a site not currently affected by it... Norse is toast ATM..

Fortinet Threat Map

 

[MindlessWork]

Can't open Reddit but Spotify opens.

 

[mudbutt22]

I've been trying to get in reddit for the last hour. Didn't know what was going on. Thanks for the heads up doc.

 

[mike5064]

My Spotify dropped out on me halfway through my workout today. I wondered what was going on. I've never had that problem with it before

 

[Michael Scally MD]

Dyn warns customers that a third cyber attack is currently underway
Dyn warns customers that a third cyber attack is currently underway

 

[Michael Scally MD]

 

[Michael Scally MD]

Why Today’s Attacks on the Internet Are Just the Start
Why Today’s Attacks on the Internet Are Just the Start

What’s happening today is hackers are explicitly targeting a company called Dyn with denial of service attacks — where a large amount of corrupt data is sent to overwhelm a company. Dyn are a cloud-based Internet Performance Management company, who provide something called “DNS services” to their customers. If DNS is like a telephone book, where you type in Twitter.comand get directed to the correct internet server, Dyn is the host for about a quarter-million of these phone book entries. That’s why big websites like Twitter and Reddit are misbehaving today.

What has happened over the last few years is businesses have consolidated to professional managed DNS providers, ironically in part due to the difficulty in mitigating denial of service attacks. This has created new centralized platforms for hackers to target.

And they are being targeted.Within the past month there was a distributed denial of service attack which totalled over 1,000 gigabits per second of traffic. That’s more bandwidth than many countries have. It’s a staggering volume of traffic, multiple times more than anything seen previously. (In 2015, Arbor networks reported what was then the world’s biggest DDoS attack: 334 gigabits per second.)

This is aiming to become the new normal. It is extremely difficult and costly to defend against — only a small number of companies can do it currently.

These attacks are driven, in part, by the “Internet of Things”—devices such as CCTV cameras and DVRs being directly attached to the internet, with poor security. Attackers are hacking these devices, inside homes and businesses across the world, to create “botnets”—a herd of infected devices, which they can use to launch attacks. Criminals are also selling attacks from these botnets for cheap prices, allowing anybody with a wallet to launch attacks against targets.

There are many examples, but here is one. This is a map of undersea cables, connecting the internet together across countries:

...

 

[Michael Scally MD]

 

[Millard]

Security expert Bruce Schneier warned last month that this might happen...

Someone Is Learning How to Take Down the Internet - Schneier on Security (September 13, 2016)

Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses...

Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they're used to seeing. They last longer. They're more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure...

What can we do about this? Nothing, really.​

 

[Michael Scally MD]

Security expert Bruce Schneier warned last month that this might happen...

Someone Is Learning How to Take Down the Internet - Schneier on Security (September 13, 2016)

Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses...

Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they're used to seeing. They last longer. They're more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure...

What can we do about this? Nothing, really.​

I cite that article in the OP!!!

 

[Michael Scally MD]

Internet of Things Scanner
Check if your internet-connected devices at home are public on Shodan. If they are, this means they are accessible to the public, and hackers.
Internet of Things (IoT) Scanner - BullGuard

 

[Michael Scally MD]

 

[Millard]

I cite that article in the OP!!!

I only read the first article in your post

 

[Michael Scally MD]

 

[Jeremiahflex]

Playstation network was down, almost had to go outside

 

[flenser]

The attack was well coordinated with the move against Assange, who has already alluded to being the cause. I'm guessing he had no idea anyone would be dumb enough to cut his internet connection, and some automated triggers went off. The attack did end abruptly after the Wikileaks tweet asking for them to stop.

"Mr. Assange is still alive and WikiLeaks is still publishing. We ask supporters to stop taking down the US internet. You proved your point."​

 

[MindlessWork]

Security expert Bruce Schneier warned last month that this might happen...

Someone Is Learning How to Take Down the Internet - Schneier on Security (September 13, 2016)

Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses...

Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they're used to seeing. They last longer. They're more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure...

What can we do about this? Nothing, really.​

If someone could find a way to take down the Internet, including all the major top level domains then it could well be the biggest catastrophe as the world economy is increasingly being dependent on the Internet. Leveraging the IoT space to launch this attack certainly exposes how insecure a lot of these devices are and manufacturers will need to harden the firmware that drives these IoT devices and there needs to be a more secure infrastructure for them.

Definitely this will become an arms race to stay ahead of the bad guys. Governments and companies need to come together to deal with this big threat.

 

[Michael Scally MD]