ISC: DNS Providers under attack 4/3/09

Reports and investigations into Distributed Denial of Service attacks.

ISC: DNS Providers under attack 4/3/09

Postby meep » Sat Apr 04, 2009 2:27 pm

Amazon S3, NeuStar (UltraDNS) and Register.com under attack. I personally did not notice much major website outages yesterday, did any of you by chance?

http://www.cymru.com/monitoring/dnssumm/

Story:
http://isc.sans.org/diary.html?storyid=6121&rss
4/3/09


We've been keeping an eye on the issues affecting the domain servers of Register.com. Several readers have written to us with concerns ofer the lack of availability of Register.com's servers, which seem to have been under a DDoS attack. There are also reports that DNS provider NeuStar (UltraDNS) may be under DDoS, too.

We don't have any information at the moment about these incidents, beyond what is reported in the following articles:

http://www.theinquirer.net/inquirer/new ... dos-attack

http://www.scmagazineus.com/DDoS-attack ... le/130060/
...
User avatar
meep
Spammers' Nightmare
 
Posts: 2777
Joined: Thu Apr 05, 2007 4:10 pm

Re: ISC: DNS Providers under attack 4/3/09

Postby meep » Thu Apr 09, 2009 10:15 am

Maybe I should create DDoS thead? - these go on all the time, but I wonder how much of it is actually reported. Most recently large webhoster, ThePlanet, was attacked:

http://www.datacenterknowledge.com/arch ... -continue/

# April 6-7: Customers of The Planet are hit by web site outages as a result of a DDoS aimed at the huge hosting company. “We will be updating DNS to mitigate attack risks further, but the attack volume was massive,” The Planet said on its Twitter stream. “Given the volume of the attack, our network operations team rerouted all name server traffic through our DDoS mitigation capabilities.” The Planet hosts more than 48,000 servers.


More at Twitter:

http://twitter.com/theplanetdotcom

# @seltice DDoS activity has completely subsided and we've made quite a few DNS improvements today ... Are the DNS zones not updating quickly? about 18 hours ago from TweetDeck

# Between 2:30am and 5:00am CDT on April 8, The Planet's name servers were flooded again with a large brute force (DDoS) attack. about 22 hours ago from TweetDeck

# Unlike the previous attack, this attack did not appear to be DNS-specific; instead, targeted resources indirectly supporting DNS services. about 22 hours ago from TweetDeck

# Because the nature of this attack was different from the previous event, mirroring the response to the previous attack was ineffective. about 22 hours ago from TweetDeck
User avatar
meep
Spammers' Nightmare
 
Posts: 2777
Joined: Thu Apr 05, 2007 4:10 pm

Re: ISC: DNS Providers under attack 4/3/09

Postby AlphaCentauri » Thu Apr 09, 2009 11:00 am

Given that Castlecops maintained a whole DDoS forum, maybe we need more than just a thread.
User avatar
AlphaCentauri
You are kiillllling-a my bizinisss!
 
Posts: 5989
Joined: Thu Mar 01, 2007 3:01 am


Return to Denial of Service Attacks [DDOS]

Who is online

Users browsing this forum: No registered users and 1 guest