Does anyone have volume or attack information? What sort of attack(s) are suspected? -Mike Kun
On Oct 21, 2016, at 1:40 PM, Sajal Kayan via Outages <outages@outages.org> wrote:
It appears most of the world cant reach Dyn : https://pulse.turbobytes.com/results/580a5178ecbe402e2201a74c/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__pulse.turbobytes.com_results_580a5178ecbe402e2201a74c_&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=xo1rCQZipTQbUei0LoYKV-rqVaj3BIcZ11klJCE8lIM&e=> But for the most part, its resolving thru Google DNS/OpenDNS : https://pulse.turbobytes.com/results/580a51ceecbe402e2201a74e/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__pulse.turbobytes.com_results_580a51ceecbe402e2201a74e_&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=QGOdvuwYNF_7tdMiWdrf0JaBxlalMIIdfStw8rcnLDE&e=>
On Sat, Oct 22, 2016 at 12:31 AM Andrew Bunde via Outages <outages@outages.org <mailto:outages@outages.org>> wrote: Don’t forget https://bit.namecoin.info/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__bit.namecoin.info_&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=rJP7Os_7EgCO59pliAnbnIx4WmpVRgaKUsTNRUIgIG8&e=>
From: Outages [mailto:outages-bounces@outages.org <mailto:outages-bounces@outages.org>] On Behalf Of Jason Antman via Outages Sent: Friday, October 21, 2016 1:25 PM Cc: outages@outages.org <mailto:outages@outages.org>
Subject: Re: [outages] Dyn outage continuing
This is just a horribly painful example of why we/they should all follow the route of NetFlix ( http://techblog.netflix.com/2013/05/denominating-multi-region-sites.html <https://urldefense.proofpoint.com/v2/url?u=http-3A__techblog.netflix.com_2013_05_denominating-2Dmulti-2Dregion-2Dsites.html&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=Z8GkKqlEGlieBt3NindCLAcFVWecC-y9JLtSKzsWPxg&e=> ) and use multiple DNS providers. Denominator ( https://github.com/Netflix/denominator <https://urldefense.proofpoint.com/v2/url?u=https-3A__github.com_Netflix_denominator&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=5IyT0KIl6YhsW30mOHzSC6O5nLy_kYKPNEzYvg2Nr7U&e=> ) the tool NetFlix uses for this and open-sourced, currently supports managing (mirrored) DNS records across AWS Route53, RackSpace CloudDNS, DynECT and UltraDNS.
-Jason
On Fri, Oct 21, 2016 at 1:09 PM, Patrick W. Gilmore via Outages <outages@outages.org <mailto:outages@outages.org>> wrote:
It is a shame in that PagerDuty is affected.
However, Dyn is far, far better positioned to withstand attacks than a company like PagerDuty could possibly be on their own. So I think PagerDuty did the right thing in using Dyn.
Remember, Twitter, Pingdom, github, and lots of other people use Dyn. And this is the first major outage I have heard of their service.
Let’s all be clear that Dyn has to be in the top 10 DNS infrastructures on the planet. Possibly the largest that sells DNS as a service. This is a serious attack, and the entire community should help track this miscreant down, then crush them like a bug.
--
TTFN,
patrick
On Oct 21, 2016, at 1:00 PM, Terry Hardie via Outages <outages@outages.org <mailto:outages@outages.org>> wrote:
It's a shame services like PagerDuty use Dyn. Now they're down too...
On Fri, Oct 21, 2016 at 9:57 AM, Justin Krejci via Outages <outages@outages.org <mailto:outages@outages.org>> wrote:
Previously it was not affecting upper midwest for me, traces went to Chicago.
Now traces to twitter DNS servers in Chicago are failing.
________________________________ From: Neil Hanlon via Outages [outages@outages.org <mailto:outages@outages.org>] Sent: Friday, October 21, 2016 11:16 AM To: Terry Hardie; outages@outages.org <mailto:outages@outages.org> Subject: Re: [outages] Dyn outage continuing
The attacks appear to be continuing again. We are experiencing issues in Europe/Asia.
On Fri, Oct 21, 2016 at 12:13 PM Terry Hardie via Outages <outages@outages.org <mailto:outages@outages.org>> wrote:
Even though their page says the outage is resolved, I'm still getting DNS failures (return SERVFAIL, not no answer) to their anycast networks from California:
$ dig @ns2.p34.dynect.net <https://urldefense.proofpoint.com/v2/url?u=http-3A__ns2.p34.dynect.net&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=nYgZcWsJA0qHxpscoM-las_Fkv2f_TC9OWy-twSs530&e=> video.twimg.com <https://urldefense.proofpoint.com/v2/url?u=http-3A__video.twimg.com&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=3YtpUj_uVR1HzhOlgLFT2JMnLwLB4rzUWdpUQq61Ht0&e=>
; <<>> DiG 9.3.2 <<>> @ns2.p34.dynect.net <https://urldefense.proofpoint.com/v2/url?u=http-3A__ns2.p34.dynect.net&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=nYgZcWsJA0qHxpscoM-las_Fkv2f_TC9OWy-twSs530&e=> video.twimg.com <https://urldefense.proofpoint.com/v2/url?u=http-3A__video.twimg.com&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=3YtpUj_uVR1HzhOlgLFT2JMnLwLB4rzUWdpUQq61Ht0&e=> ; (1 server found) ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 170 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION: ;video.twimg.com <https://urldefense.proofpoint.com/v2/url?u=http-3A__video.twimg.com&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=3YtpUj_uVR1HzhOlgLFT2JMnLwLB4rzUWdpUQq61Ht0&e=>. IN A
;; Query time: 3103 msec ;; SERVER: 204.13.250.34#53(204.13.250.34) ;; WHEN: Fri Oct 21 17:11:36 2016 ;; MSG SIZE rcvd: 33 _______________________________________________ Outages mailing list Outages@outages.org <mailto:Outages@outages.org> https://puck.nether.net/mailman/listinfo/outages <https://urldefense.proofpoint.com/v2/url?u=https-3A__puck.nether.net_mailman_listinfo_outages&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=XPLQiTtTSnqFkQpyPWGEQCbi4k2BRGuDxT51QCjhMpY&e=>
--
KAYAK
Neil Hanlon
Devops Engineer
+1 978 902 8171 <tel:%2B1%20978%20902%208171>
_______________________________________________ Outages mailing list Outages@outages.org <mailto:Outages@outages.org> https://puck.nether.net/mailman/listinfo/outages <https://urldefense.proofpoint.com/v2/url?u=https-3A__puck.nether.net_mailman_listinfo_outages&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=XPLQiTtTSnqFkQpyPWGEQCbi4k2BRGuDxT51QCjhMpY&e=> _______________________________________________ Outages mailing list Outages@outages.org <mailto:Outages@outages.org> https://puck.nether.net/mailman/listinfo/outages <https://urldefense.proofpoint.com/v2/url?u=https-3A__puck.nether.net_mailman_listinfo_outages&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=XPLQiTtTSnqFkQpyPWGEQCbi4k2BRGuDxT51QCjhMpY&e=>
_______________________________________________ Outages mailing list Outages@outages.org <mailto:Outages@outages.org> https://puck.nether.net/mailman/listinfo/outages <https://urldefense.proofpoint.com/v2/url?u=https-3A__puck.nether.net_mailman_listinfo_outages&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=XPLQiTtTSnqFkQpyPWGEQCbi4k2BRGuDxT51QCjhMpY&e=>
_______________________________________________ Outages mailing list Outages@outages.org <mailto:Outages@outages.org> https://puck.nether.net/mailman/listinfo/outages <https://urldefense.proofpoint.com/v2/url?u=https-3A__puck.nether.net_mailman_listinfo_outages&d=DQMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=JKX8L6GOKvRiNpSp-mnjjQ&m=NlUSnBfE_pOQTYFrnNz03CXHFDf-thc56BitRGGX2HE&s=XPLQiTtTSnqFkQpyPWGEQCbi4k2BRGuDxT51QCjhMpY&e=> _______________________________________________ Outages mailing list Outages@outages.org https://puck.nether.net/mailman/listinfo/outages