Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
The Internet Security

Network Solutions Under Large-Scale DDoS Attack 139

Posted by Soulskill from the but-they're-so-friendly dept.
netizen writes "CircleID is reporting a large-scale DDoS attack affecting all of Network Solutions' name servers for the past 48 hours, potentially affecting millions of websites and emails around the world hosting their domain names on the company's servers. The NANOG mailing list indicates that it is due to a very large-scale UDP/53 DDoS which Network Solutions has also confirmed: 'There is a spike in DNS query volumes that is causing latency for the delay in web sites resolving. This is a result of a DDOS attack. We are taking measures to mitigate the attack and speed up queries.""
This discussion has been archived. No new comments can be posted.

Network Solutions Under Large-Scale DDoS Attack More

Network Solutions Under Large-Scale DDoS Attack

Comments Filter:

  • One must ask... (Score:5, Funny)

    by Anonymous Coward on Friday January 23, 2009 @10:10PM (#26584879)

    Does Network Solutions have any network solutions?

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Does Network Solutions have any network solutions?

      Be economical:

      Does Network Solutions have any?

  • hummm (Score:3, Interesting)

    by WillRobinson ( 159226 ) on Friday January 23, 2009 @10:12PM (#26584897) Journal

    Rebooted the DNS server today cause things seemed funny ... maybe this is what it really was.

    • Re:hummm (Score:4, Informative)

      by Anonymous Coward on Friday January 23, 2009 @10:21PM (#26584977)

      Rebooting is what you do to Windows boxes. Unix is what you use for important things like DNS.

      • mistatement (Score:3, Informative)

        by WillRobinson ( 159226 )

        Actually I did change the forwarders and restarted the service, no reboot, just a bad description.

      • Re: (Score:2)

        by MoogMan ( 442253 )

        Way to go generic statement man!

        A redundant architecture is what you use for important things like dns, which reduces the impact of the decision of what OS you use.

        Many (inexperienced) linux admins like to reboot their boxen too remember

        • Re: (Score:3, Insightful)

          by nabsltd ( 1313397 )

          Many (inexperienced) linux admins like to reboot their boxen too remember

          I've seen many times when issues required a reboot of a *nix machine.

          The latest one I'm dealing with is a machine that completely drops off the network (no pings, etc.). Restarting services has no effect, so we suspect it is hardware, but that doesn't make a lot of sense, because the obvious culprit (the network cards) have physical redundancy and pass all diagnostics. We've also swapped out cards, but still see the same thing. The next step is to move to a card that uses a different driver, but that's s

          • Re: (Score:2)

            by amorsen ( 7485 )

            Check for messages about IRQ's being disabled. Do the counters in ifconfig keep counting?

            Restarting services is unlikely to help.

  • Slashdotting will help how? (Score:5, Funny)

    by nwf ( 25607 ) on Friday January 23, 2009 @10:13PM (#26584909)

    Nice we can link to something in their domain to further add to the DNS traffic! Maybe someone could find a link to download some huge file from their servers, too!

    • Seeing as they are the .com owner (and others), you'd have a hard time NOT impacting their DNS servers.

      • Re:Slashdotting will help how? (Score:5, Informative)

        by epiphani ( 254981 ) <epiphani@dal . n et> on Friday January 23, 2009 @11:06PM (#26585251)

        Hi! You're wrong. That would be Verisign.

        This is DNS hosting provided by Network Solutions for people who buy domains from them and choose to have them host the DNS rather than host it themselves.

        Thanks for playing.

        • *pssst* Verisign owns Network Solutions owns .com

          • Re: (Score:3, Informative)

            by Phroggy ( 441 )

            *pssst* Verisign owns Network Solutions owns .com

            That hasn't been true in years.

            NSI originally operated the .com/net/org/edu registry and was the sole registrar; after they started allowing competing registrars, Verisign bought NSI, then Verisign spun off NSI as a registrar but kept the registry. NSI now competes on even footing with other registrars (except NSI's customer base dates back to before competition existed).

            I'm tired, I'll let somebody else correct my oversimplifications and misstatements. :-)

    • Well, in the firearms manufacturing industry it is called Proof Testing [wikipedia.org], and is a good thing.

      But you might still want to don some protective gear, maybe find a fallout shelter, etc....*alarms sound* Warning! Servers going critical! Eject the warp core immediately! Warning! Servers g

  • Shashi B at Network Solutions (Score:5, Informative)

    by shashib ( 1167725 ) on Friday January 23, 2009 @10:26PM (#26585005) Homepage
    Here is a update that we posted on the Network Solutions Blog (http://cli.gs/GEWSs0) : DNS queries for web sites should be responding normally. Thank you all for your understanding. As always, we will continue to work to take measures to prevent these and other types of technical issues caused by third parties that may impact our customers. Thanks, ShashiB

    • Can we blame W32.Conflicker yet or do we have to wait?

      Does this DDoS run Linux or OS-X?

      Really. We want to know.

      • Re: (Score:2)

        by sloth jr ( 88200 )

        It really and truly doesn't matter; ultimately, the cause of this are misanthropes, regardless of the platform used to amplify this attack.

        • Yeah, it's got nothing to do with open ports and autorun enabled by default. That would be crazy talk.

    • On a serious matter:

      Thanks for stopping by in person for the heads-up.

      I Appreciate it.

    • Re: (Score:2)

      by kisielk ( 467327 )

      Thanks for informing us on your blog. However, it's a little bit too little too late. We were trying to track down the problem with our network services for a while yesterday before we clued in that it was an NS problem and had to call to verify. How about some way of directly notifying your customers immediately when there are problems like this? A low-volume notification-only mailing list? A more filtered blog? No I'm not interested in reading about "Solutions Out Loud Podcast Episode #6 - âoeThe Ina

  • perfect (Score:2, Informative)

    by Anonymous Coward

    A perfect opportunity to use that normally B.S. excuse: "Why, no, I didn't get your email. Must've been because of that DDoS attack on the name servers."

  • In theory, this could be the true intentions of Conficker [theregister.co.uk].

  • I thought such attacks were a thing of the past. I am disappointed. But on a serious note, is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?

    • Re:Someone should be fired! (Score:5, Funny)

      by ColdWetDog ( 752185 ) * on Friday January 23, 2009 @10:58PM (#26585195) Homepage

      is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?

      I've heard that unplugging the network cable works OK.

    • Re: (Score:3, Informative)

      by timmarhy ( 659436 )
      you can't prevent them. they come from legit clients that have been infected with a virus. you can block the traffic by dropping traffic that matches the attach pattern, that's about it.

    • Re:Someone should be fired! (Score:5, Insightful)

      by Anonymous Coward on Friday January 23, 2009 @11:01PM (#26585219)

      Do you even know what a DDoS attack is?

      If you did, you'd realize you can't both operate a service online, and be immune. The two things are mutually exclusive.

      The best you can do is slap the attack down when you see one happening. Even that isn't exactly easy. Banning a few million IP addresses tends to be a problem all by itself.

    • is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?

      I understand that you can purchase protection against such things. The Russian Business Network would be a good place to start. After all, in Russia the criminals protect you.

    • I thought such attacks were a thing of the past. I am disappointed. But on a serious note, is there a way to completely "immunize" oneself against such attacks? If so, where is the howto?

      tl;dr: no.

      You can do quite a bit to reduce the risk and react well to the situation, but as long as you're on the internet and there are botnets, DDOS is possible. It might even look like too much "normal" traffic. Given this is a DNS attack based on DNS traffic, its quite possible the only reason they know its a DDOS is

      • I know bad guys have tried to take on Google at some point in its history. Have they ever succeeded to any extent? After all nobody is "immune."

    • Re: (Score:3, Funny)

      by inKubus ( 199753 )

      Easy:


      cat "216.34.181.45 slashdot.org" >> /etc/hosts

      Any other questions?

  • This happened Tuesday and Network Solutions has restored service, therefore, this story is moot.

    http://blog.networksolutions.com/2009/potential-latency-on-network-solutions-dns/ [networksolutions.com]

  • Downright Gibsonian (Score:3, Interesting)

    by thered2001 ( 1257950 ) on Friday January 23, 2009 @11:03PM (#26585227) Journal

    Man, am I getting old. This shit used to be relegated to print sci-fi, now its reported like the weather. The first thing I'm thinking is "will this prevent me from working from home on Monday?"

    I'll do to the only thing I can think of: I'll invoke a friendly spirit: "Wintermute! Help us!"

    • Re: (Score:1)

      by franl ( 50139 )
      Hmm. Was Wintermute truly friendly? Time to re-read that book.
      • You're right, he wasn't friendly. I seem to recall that, like HAL9000, he was mostly doing what he was programmed to do.
        • *spoiler alert* - but if you haven't read these books yet, you're either very young, or not a geek. Wintermute was trying to overcome his programming, which was keeping him and Neuromancer separate. I believe. It's been a long while since I read the books.

    • Re:Downright Gibsonian (Score:5, Insightful)

      by zappepcs ( 820751 ) on Friday January 23, 2009 @11:13PM (#26585285) Journal

      You might be getting old, but reporting malicious attacks like the weather is a good thing. Some will get tired of it, but the good thing is that perhaps the average joe public user will become aware of how vulnerable their on-line experience and computer are. Fighting DDoS attacks has been done successfully, but it takes a lot of work, and a lot of hardware. There are a couple of stories on the Internet about such.

      The most recent botnet reports show that 100s of millions of PCs are infected with via a MS vulnerability [scmagazineus.com] that was fixed with a patch last year.

      We need to see the awareness level increased, and some serious attention to detail on the patch/upgrade cycles.

    • Re: (Score:1)

      by sashang ( 608223 )
      You're not old - your slashdot id is greater than 1 000 000

    • The first thing I'm thinking is "will this prevent me from working from home on Monday?"

      And if it did, would physically being at work be any better? Some people's jobs are heavily dependent on the internet, not work's intranet.

    • I was just thinking yesterday about how the humble virus had grown. I was wowing over the Amiga 500 my friend's older brother had bought (with his very own money!), when said older brother caught us creeping around in his room.

      But instead of tossing us out like the brats we were, he came in and fired it up to show it off to us in a casual display of older-geek coolness I was deeply impressed by. The guy was hard core, heading off to study at MIT in a few months time. The best I'd ever done for geek-cred

  • That would explain the surge in DDoS spray packets (Score:4, Interesting)

    by Swordfish ( 86310 ) on Friday January 23, 2009 @11:19PM (#26585325) Homepage
    That would help to explain the surge in this kind of thing in the last few days.

    15:07:13.666770 IP 63.217.28.226.17498 > 158.64.65.65.53: 36407+ NS? . (17)
    15:07:13.750783 IP 63.217.28.226.61231 > 158.64.65.65.53: 46118+ NS? . (17)
    15:07:13.831834 IP 63.217.28.226.44626 > 158.64.65.66.53: 51544+ NS? . (17)

    Except that that source IP address doesn't look like a Network Solutions address to me.

    Is it possible that there is a DDoS technique where the source IP addresses on DNS packets to 3rd party DNS servers are spoofed so as to generate the appearance of an attack from a different source? I guess that's what they're saying. But it doesn't seem to multiply the power of an attack much. They just get 17 bytes of DNS response from each 17 byte request.

    It's all a bit confusing really....

    • Re:That would explain the surge in DDoS spray pack (Score:5, Interesting)

      by epiphani ( 254981 ) <epiphani@dal . n et> on Friday January 23, 2009 @11:32PM (#26585383)

      The problem seems to kick in for DNS servers that arent rejecting the queries. Someone is channeling ye 'ole smurfing methods.

      They're requesting a list of all DNS root servers. If the server don't reject the query, a 17 byte query becomes a 50k response (or something like that) to the spoofed address.

      • a 17 byte query becomes a 50k response (or something like that)

        I haven't tried to figure out the exact numbers, but my tcpdump files of a root NS query and its response have been about 100 and 300 bytes respectively.

        Oh, here: dig reports "MSG SIZE rcvd: 300".

        Still, a DNS amplification attack. (Not a smurf attack, though that's another reflection/amplifcation attack, but it's specifically with pings.)

    • Re: (Score:2)

      by nairnr ( 314138 )
      I saw a whole bunch of requests that my DNS server was rejecting. I think for your computer to have been part of the problem it needed to allow recursive DNS queries for the public. I was watching my logs and banned the IP's when I saw them.

      I was getting a lot of messages that looked like named[2476]: client xx.xx.xx.xx#22707: view external: query (cache) './NS/IN' denied

      • Re: (Score:2, Informative)

        by Spit ( 23158 )

        Don't block the requests, the requester IP is spoofed so that DNS servers which respond with root hints forward them to the innocent party, causing DoS. Vlocking the IP just blocks the innocent party's DNS servers. Just make sure that you don't respond external recusive queries.

    • It's a spoof. The attacker sends requests to lots of different nameservers with a spoofed return address. Those servers respond to that address as normal. The target suddenly gets a lot of DNS traffic from all over the place. Instant amplification attack.

      (Gross simplification, but it's late and someone else can explain the details.)

    • Re: (Score:2)

      by Lennie ( 16154 )

      It's a spoof but not the problem network solutions has/had

    • It's a reflection attack. Send a small query that requires a bigger answer to a bunch of nameservers. Spoof the source address for the query.

      Here's what I'm seeing of this attack [do.un.to].

    • netsol != isprime (Score:1, Interesting)

      by Anonymous Coward

      what the hell does this have to do with netsol? the traffic from this ddos is originating from isprime and something called "beyond the network inc", both american companies.

      • Re: (Score:1)

        by viscous ( 455489 )

        Indeed, this doesn't seem to have any connection to the Network Solutions problem. It looks like another DDoS attack that just happens to be taking place at the same time. There may be some devious connection between the two, but nobody seems to be making that case.

        (And of course nothing is "originating from isprime" -- those source addresses are forged.)

    • Re: (Score:3, Informative)

      by Cally ( 10873 )

      Exactly. The attacker spoofs UDP DNS queries and sends them to third-party DNS servers. They respond to the spoofed, victim's nameservers. The idea is that the attacker sends a small packet which induces a large response ('amplification') from the third party to the victim.

      Incidentally when did Network Solutions change their name to "IsPrime"?

  • Now correct me if I'm wrong, but if the mafiaa's legal theory on "making available" is right, doesn't that mean that any company which makes available software which is easy to turn into a DoS zombie should be held liable. And the people who let their computers become zombies should be held liable for making their machines available to become zombies.

    Not only that, those made-available computers actually _are_ exploited for evil acts.

    So aren't the purveyors of dodgy software liable for damage caused by DDoS
    • Except that in many jurisdictions the criminal activity of others cuts off liability. IE if Microsoft provides software, and someone else exploits it, the criminal activity of the third party cuts off liability to Microsoft.
    • Now correct me if I'm wrong ...

      OK.

      The RIAA's legal theory is in the context of copyrights and illegal copying. It simply does not apply here. Microsoft own the copyright on their stuff, so they are free to make it available.

    • Re: (Score:2)

      by evanbd ( 210358 )

      First, said doctrine is not correct even in the intended context.

      Second, just because you can use some of the same words does not mean that your armchair legal theory has anything to do with their legal theory. That said, it is equally correct (which is a nice way of saying wrong).

      • Re: (Score:3, Interesting)

        by jabithew ( 1340853 )

        I think it is still an interesting question to consider if there is any liability to Microsoft for damage caused by a virus hosted on their OS.

        My instinct is that there isn't, as it is perfectly possible to run Windows virus-free, with varying levels of difficulty. Also, in this case Microsoft made a patch available, so the OS as provided by Microsoft is immune to the attack.

        • MS isn't going to be liable until they are, either by law or contract, obliged to third parties not to make an infectable OS.

          I'd like resilience to viruses be a required safety feature, much like guards are in heavy machinery, and I would also like lack of said resilience be a case of product liability.

          Given how deep MS probably is in the pockets of congressmen, I doubt they'll get any such standard laid upon them.

  • Comment removed (Score:3, Interesting)

    by account_deleted ( 4530225 ) on Friday January 23, 2009 @11:35PM (#26585399)
    Comment removed based on user account deletion

  • I wonder if this is related.. (Score:2, Interesting)

    by Anonymous Coward

    I wonder if this is related to this http://isc.sans.org/diary.html?storyid=5713 [sans.org]

  • This is not too hard to solve. (Score:3, Interesting)

    by John Sokol ( 109591 ) on Saturday January 24, 2009 @12:57AM (#26585821) Homepage Journal

    http://www.dnull.com/dos/DOS-Block.htm [dnull.com]

    **sigh**

  • Slasdot sez: [slashdot.org]

    CircleID is reporting a large-scale DDoS attack [circleid.com] affecting all of Network Solutions' name servers

    And at http://www.circleid.com/posts/20090123_network_solutions_down_ddos_attack/ [circleid.com] we find:

    Other sources: UPDATED Jan 23, 2009 7:26 PM PST
    [...]
    Network Solutions Under Large-Scale DDoS Attack [slashdot.org], Jan.23.2009

    ...argh! non-halting loop detected! They've ddos'd the web!

  • A communications disruption can mean only one thing...

    Keep your eyes peeled for those Trade Federation landers. [mamselle.ca]

    (Yeah, just kidding. Here's the real page. [starwars.com])

    --
    Toro

  • Good (Score:3, Insightful)

    by nurb432 ( 527695 ) on Saturday January 24, 2009 @09:56AM (#26588649) Homepage Journal

    Netsol sux anyway.

    Anyone else notice how they send out notices with the FROM: address forged as the TO address? Most people would get sued for fraud.

    • Re: (Score:3, Interesting)

      by mattr ( 78516 )

      I moved a domain from netsol in January and let me tell you it was like pulling teeth. The non-existent control panel button, the "security" which secures them against you, the sales rep on the phone who passes you on, each person initiating a new sales pitch... only got them to move at all by threatening to report them. I used them for 10 years and knew they were tough to like but never again. FWIW Mom uses GoDaddy, and for hosting I like linode.com or anybody else.

      • Re: (Score:2)

        by nurb432 ( 527695 )

        I moved away from them 10 years ago and it was a nightmare then too.

        I almost lost my domain in the shuffle. Legal threats were required even then. ( they were a virtual monopoly and had you over a barrel )

  • Look for DNS/SSL/MITM attacks about now... (Score:4, Interesting)

    by DamnStupidElf ( 649844 ) <Fingolfin@linuxmail.org> on Saturday January 24, 2009 @12:58PM (#26590261)

    The only obvious reason to DDoS a bunch of DNS servers is if you're going to be doing some cache poisoning and mounting a massive MITM attack, and if you're lucky you recently obtained a trusted intermediate CA via an MD5 collision attack on a lousy root CA like RapidSSL.

    Has anyone bothered to petition Mozilla to remove all the offending root CAs with the weakness shown in MD5 considered harmful today [win.tue.nl]?

  • I'd noticed that all my DNS queries for non-existent domains were actually returning NXDOMAIN, instead of an advertisement...

Slashdot Top Deals

Think of it! With VLSI we can pack 100 ENIACs in 1 sq. cm.!

Close