Massive botnet responsible for wave of DDoS attacks

A host of popular websites are experiencing issues Friday, including GitHub, Twitter and Spotify, due to multiple distributed denial of service attack directed at a managed domain name server company.

A botnet leveraging unprotected Internet of Things devices is partly responsible for the outages that wreaked havoc with the internet Friday.

A slew of popular websites were intermittently or completely offline Friday, including Box, GitHub, PayPal and Twitter,  due to the attacks directed at Dyn, which provides managed domain name server service.

Dyn released a statement Friday saying they began monitoring and mitigating a DDoS attack against their Managed DNS infrastructure around 7:10 a.m. EST. The attack is impacted mainly the U.S. East Coast.

https://twitter.com/Dyn/status/789444349998268416

Sites have been working intermittently during the attack, but outage maps from a variety of websites shows problems on both the East and West Coast. The company remedied the morning attack by 9:20 a.m.

Around 12:15 p.m. Friday, Dyn aid it’s mitigating another DDoS attack. The company said its advanced services have been impacted, with possible delays in monitoring. A status message on Amazon Web Services’ website states the company is having problems with its West-1 Region due to the afternoon attack.

Around 4:30 p.m. EST Friday, the company announced a third wave of attacks, which consisted of “tens of millions of IPs” was being carried out. The company told CNBC the attack was “sophisticated and well coordinated.”

Gizmodo has a full list of sites that are experiencing outages.

In a recorded Q&A on Periscope, Level 3 Chief Security Officer Dale Drew explained the DNS DDoS attack is different when compared to a plain DDoS attack: While a DDoS attack points a large portion of junk traffic at a target in the hope that it blocks all legitimate traffic, a DNS DDoS attack is forcing queries on web hosts as fast as possible so Dyn’s system is spending so much resources responding to each of those queries that it doesn’t have time for a legitimate request. 

“The bad guys are going through legitimate DNS providers and making queries,” Drew said. “They are making a significant amount of queries, they are getting completely overwhelmed and cannot answer legitimate queries from real questions.”

The Domain Name System, or DNS, is the directory assistance service that points to IP addresses to website addresses (like CyberScoop.com).

According to the company’s website, Dyn provides internet performance services, including DNS-related services, to eight of the top 10 internet services and retail companies, and six of the top 10 entertainment companies listed in the Fortune 500. It counts SoundCloud, BT, Hershey, Twitter, The Guardian and Seeking Alpha among its clients.

Drew also said that a portion of the traffic can be traced back to the Mirai botnet, which uses poorly secured Internet of Things devices like smartphones, live cameras and routers to augment the attack’s size. Mirai been a rash of massive DDoS attacks over the past few weeks, most notably the biggest one ever recorded that took independent journalist Brian Krebs’ blog offline for a number of days.

The source code for the botnet responsible for that attack, has been adopted by random hackers and used against new targets. Drew said in his video that those responsible for today’s outage is leveraging Mirai, as well as other botnets.

Earlier this month, experts told CyberScoop that Mirai’s spread symbolizes a shift in hackers’ capabilities.

“These recent, large attacks are most likely a harbinger for what the industry will likely now face on a more regular basis,” said Martin McKeay, Akamai’s senior security advocate.  “This happens every couple of years. A new attack – think of Operation Abibal from a couple of years ago — creates a new high water mark. Those providing mitigation create new defenses against the attacks, only to have the attackers evolve further. It’s a vicious cycle and one that will continue for as long as people want to DDoS websites.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure