If you were on the internet today, as you may have been if you’re reading this, then you probably noticed some sites are having trouble loading, and others are not working at all. There’s a good reason for that. Well, not a good reason, but a clear, obvious reason: someone is attacking the internet, and they’re succeeding.
The attacks have a single primary target: a company called Dyn DNS. The company is a middleman on the internet, providing the DNS service that routes requests from your computers or phones to the websites that are your final destination. When everything works smoothly, Dyn has a low profile, and there’s little reason to give it a second thought. But when the DNS servers go down, internet traffic can’t get anywhere, so popular sites are unreachable, and users are left wondering what, exactly, went wrong.
The attacks have blocked everything from Grubhub to Github, leaving the hungry, the nerdy, and everyone else, with an internet experience that’s sorely lacking. Dyn was shut down by a distributed denial of service (DDoS) attack, part of a wave of increasingly larger and larger DDoS attacks, launched from hordes of otherwise innocuous “smart” internet-connected devices that have been hacked.
In the past, major outages could be as much a matter of human error as a carefully selected attack. But the attack on Dyn isn’t a human failure so much as an infrastructure vulnerability, and one that’s only expected to grow. The botnet attack that overwhelmed Krebs and French firm OVH convinces servers to overload each other with requests, and to exploit security protocols on public networks.
In a profile of the DDoS bot for F5, Liron Segal writes: “considering the low cost to maintain an IoT DDoS botnet, and referring to Gartner’s forecast3 stating connected things…will reach 20.8 billion by 2020, we can assume the IoT infection vector to grow. We should anticipate DDoS attacks over 1 Tbps to become more common in the near future”
In the meantime, what can a user do? Find a different domain name server to start. Dyn’s DNS servers are extremely popular, but they’re not the only ones, and it’s easy for users to seek out a different server that’s not under attack. Daily Dot has a guide to getting around the Dyn outage. That will hold for now, but massive attacks, carried by Internet-of-Things things, will only stop when people stop making poorly secured Wi-Fi-connected juicers and Bluetooth-enabled umbrellas. At the very least, the companies that make smart egg-minders and cat-tracking water fountains need to continuously invest in security.
Dyn posted the below update;
Our engineers continue to investigate and mitigate several attacks aimed against the Dyn Managed DNS infrastructure.
DDoS attack is reportedly targeted towards US servers — mainly throughout east cost — and that’s where the main damage has been done. Servers in Asia and Europe are to remain less impacted during the time. Early reports are saying that this is one of the largest DDoS attacks in the history, which is still ongoing.
Some of the major websites and online services that have been affected due to the attack include:
- New York Times
- Business Insider
- Boston Globe
- Vox Media properties and others.
- Sony’s Play Station Network
- Xbox Live