Distributed malware attacks Dyn DNS, takes down websites in US

Monday, October 24, 2016

The third attack distribution as provided by downdetector.com and OpenStreetMap.

On Friday, a network of diverse Internet-connected devices targeted the Dyn domain registration service provider. It took down Dyn clients, including several popular websites such as Twitter, Netflix, Spotify, Reddit, New York Times, and Wired.

The attack involved targeting Dyn's domain name system servers with a large volume of requests, rendering it incapable of serving replies to legitimate requests — a DDoS (distributed denial of service) attack. Users' browsers and other clients sent requests to Dyn to resolve the respective web sites' domain names to an IP, but did not get a reply within the time required.

The first attack started at about 7am local time (UTC-4) and was resolved in two hours. A second attack started at mid-day, and a third attack started at about 4pm local time. Tens of millions of malicious request sources were observed, interfering with legitimate Dyn traffic.

The reports noted the malicious devices included internet-connected devices — not only servers and desktops, but also webcams, digital video recorders, routers — referred to as the Internet of Things.

On Friday evening Dyn said a security company Flashpoint and a cloud services provider Akamai identified symptoms of malware Mirai participating in the attacks. The malware infects the devices by brute forcing their passwords. This strategy may work as a consequence of users' negligence towards password security of stationary devices, which the users do not directly interact with in their everyday life while leaving them exposed to the Internet.

Matthew Prince, the CEO of an Internet infrastructure company Cloudflare said it's a known issue, "There's nothing really new about [this type of DDoS attack]. We've seen them for at least the last three years, they tend to be difficult to stop".

Public release of Mirai source code was announced at Hackforums on September 30.

Dyn's corporate headquarters are in New Hampshire.

Have an opinion on this story? Share it!

Sources

"Update Regarding DDoS Event Against Dyn Managed DNS on October 21, 2016" — Dyn (company), October 22, 2016
Nick Statt. "How an army of vulnerable gadgets took down the web today" — The Verge, October 21, 2016
Lily Hay Newman. "What We Know About Friday’s Massive East Coast Internet Outage" — Wired (magazine), October 21, 2016
Jerry Gamblin. "Commits for jgamblin/Mirai-Source-Code" — GitHub, October 5, 2016
"Largest ever DDoS attack: Hacker makes Mirai IoT botnet source code public" — International Business Times, October 3, 2016
Mary-Ann Russon. "Source Code for IoT Botnet ‘Mirai’ Released" — Krebs on Security, October 1, 2016

Share this:

This page is archived, and is no longer publicly editable.

Articles presented on Wikinews reflect the specific time at which they were written and published, and do not attempt to encompass events or knowledge which occur or become known after their publication.

Got a correction? Add the template {{editprotected}} to the talk page along with your corrections, and it will be brought to the attention of the administrators.

Please note that due to our archival policy, we will not alter or update the content of articles that are archived, but will only accept requests to make grammatical and formatting corrections.

Note that some listed sources or external links may no longer be available online due to age.

The text of this article is licensed under the terms of the Creative Commons Attribution 2.5 License