On: DDoS Attack Against Dyn Managed DNS

[chromaton]

I can't currently get resolution on www.paypal.com.

$ dig @8.8.8.8 www.paypal.com

; <<>> DiG 9.8.1-P1 <<>> @8.8.8.8 www.paypal.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 17925 ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION: ;www.paypal.com. IN A

;; Query time: 29 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Fri Oct 21 12:35:33 2016 ;; MSG SIZE rcvd: 32

[shredprez → chromaton]

Chiming in as a TWC user on the West Coast:

Github out, Etsy out, Paypal out, Twitter out, Soundcloud out, Crunchbase out, Heroku out, Spotify intermittent, Netflix only loads a white page with plaintext "who's watching" list and no functionality.

[chromaton → chromaton]

And it's back again. I'm on AT&T in Atlanta.

  $ dig @8.8.8.8 www.paypal.com

  ; <<>> DiG 9.8.1-P1 <<>> @8.8.8.8 www.paypal.com
  ; (1 server found)
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40999
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 0

  ;; QUESTION SECTION:
  ;www.paypal.com.      IN  A

  ;; ANSWER SECTION:
  www.paypal.com.    266  IN  CNAME  www.paypal.com.akadns.net.
  www.paypal.com.akadns.net. 29  IN  CNAME  ppdirect.paypal.com.akadns.net.
  ppdirect.paypal.com.akadns.net.  299 IN  CNAME  wlb.paypal.com.akadns.net.
  wlb.paypal.com.akadns.net. 29  IN  CNAME  www.paypal.com.edgekey.net.
  www.paypal.com.edgekey.net. 20  IN  CNAME  e3694.a.akamaiedge.net.
  e3694.a.akamaiedge.net.  19  IN  A  23.73.8.114

  ;; Query time: 146 msec
  ;; SERVER: 8.8.8.8#53(8.8.8.8)
  ;; WHEN: Fri Oct 21 13:05:48 2016
  ;; MSG SIZE  rcvd: 198

[roland-s → chromaton]

Paypal and others still down for me at University of California (I think we're our own ISP?)

[heyts → chromaton]

I'm in New-York too and can't resolve Paypal, Etsy, Soundcloud, Github, Netflix, Heroku or Twitter

[devy → heyts]

I'm in NYC too. Github.com is resolving/working fine. Netflix.com is resolved but all assets (probably) weren't loading. Additionally Zendesk is also affected.

[graedus → devy]

NYC, fios: github, twitter, soundcloud, heroku back up for me. Tunneling through an ec2 instance on us-east-1d gives the same results - can't find anything that is unreachable now.

[cocktailpeanuts → devy]

Github, Twitter, Quora down in Williamsburg. But Gitlab, Stackoverflow is not

[misiti3780 → devy]

github is down for me in LES

[tekromancr → misiti3780]

I'm in midtown on TWC. All the things mentioned are down.

[oAlbe → chromaton]

Quote from the status page:

> This attack is mainly impacting US East and is impacting Managed DNS customers in this region.

I'm in Italy, using my provider's default DNSs (not Google) and I can't reach paypal.com, thenextweb, twitter, spotify etc either.

[sschueller → chromaton]

Interesting. 8.8.8.8 is not able to provide me with a record. However ns1.p57.dynect.net and ns3.p57.dynect.net give an answer where as ns2.p57.dynect.net and ns4.p57.dynect.net hang.

Shouldn't 8.8.8.8 query another name server if one fails to respond or takes too long?

EDIT: Is there an inherent flaw in how secondary records are queried? And as bhauer mentioned, is there a possibility to fall back to last known record?

[teoruiz → chromaton]

Exactly the same right now from Spain. It seems the attackers are now targeting Dyn's European servers.

[whydid → chromaton]

Me either. I'm in NYC on TWC. I can't resolve PayPal with Google's DNS or with TWC dns servers.

Also, I'm unable to resolve Twitter on TWC dns.

[zeronzr → chromaton]

https://www.whatsmydns.net/#A/art.nflximg.net

http://status.aws.amazon.com/

Seems like it is affecting another regions now.