IoT devices Used in DDoS Attacks
-
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
Well, that would violate one of the first business rules of IT. I mean... that alone would be a reason not to use the EHR in my mind. I would never consider the possibility that they were that incompetent at a business protection level. But even if they were that foolish, there is zero lock in from doing that. That's not a real thing.
-
Well OpenDNS specificly caches DNSs longer than most so it likely would fix all issues as even if Dyn's servers were down longer than the entries TTL OpenDNS would still use it.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
-
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
-
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
No different than your EHR moving from Dyn to CloudFlare. Would take like five minutes, literally.
-
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
No different than your EHR moving from Dyn to CloudFlare. Would take like five minutes, literally.
But then it takes hours for those changes to propogate worldwide, doesn't it? Generally I've seen minutes, but it's usually half an hour at best, and I've seen it take as long as 48 hours at worst.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
IIRC, and I probably don't, but doesn't Cloudflare do distributed DNS on their own? So a DDoS attack against their DNS infrastructure would be ineffective.
-
@dafyre said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
No different than your EHR moving from Dyn to CloudFlare. Would take like five minutes, literally.
But then it takes hours for those changes to propogate worldwide, doesn't it? Generally I've seen minutes, but it's usually half an hour at best, and I've seen it take as long as 48 hours at worst.
Depends on the TTL.
-
@dafyre said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
No different than your EHR moving from Dyn to CloudFlare. Would take like five minutes, literally.
But then it takes hours for those changes to propogate worldwide, doesn't it? Generally I've seen minutes, but it's usually half an hour at best, and I've seen it take as long as 48 hours at worst.
Just a few minutes, generally. At least for most of the world. So you'd solve the 90% within ten minutes, 99% within the hour.
-
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
I understand that, but IF they did, and Dyn was inaccessible, then the EHR provider would not be able to change it until either the attack was mitigated/over or the EHR vendor got someone one the phone at Dyn - but I'm not sure that would even matter... wouldn't the root hints still have to talk to Dyn to get the SOA for the EHR vendor? or is the SOA stored in the root hints, I'm fuzzy on that part.
-
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
-
@dafyre said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
No different than your EHR moving from Dyn to CloudFlare. Would take like five minutes, literally.
But then it takes hours for those changes to propogate worldwide, doesn't it? Generally I've seen minutes, but it's usually half an hour at best, and I've seen it take as long as 48 hours at worst.
Yeah, if you know of a move ahead of time, you can change the TTL to say, 15 minutes, and really speed that up. Doesn't help with something hitting you out of the blue tho.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
I hear University of Pheonix has you covered
-
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
That's not a viable DDoS vector as you just move.
I don't understand how this was such a big outage. DNS is designed to be resilient because of its simplicity. Why companies are still only using a single DNS provider is beyond me.
I only use a single DNS provider. I use Cloudflare. I did buy my domain name from someone else though.. so moving it like scott said would be typically pretty fast if Cloudflare was under attack.
IIRC, and I probably don't, but doesn't Cloudflare do distributed DNS on their own? So a DDoS attack against their DNS infrastructure would be ineffective.
I don't follow. The SOA still has to be on the listed IPs. If all of the listed IPs are being attacked at once, you can't get away from it.
In the case of Dyn, I would assume either A) all of the IPs are behind a singular pipe (horrible design) or there was only one.
-
My EMR vendor has now expanded to 3 DNS providers, and from what I can tell, at least one of them is based in Europe.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
It's not for you to have heard of. It's nothing to do with IT. It's a fundamental business concern. Any business manager should just know this. It's not a technical thing (well, it is... single point of failure, general risk) it's purely standard business knowledge. Really, it's just common sense. The whole system exists the way that it does to make sure you are never stuck with one company owning you.
-
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
It's not for you to have heard of. It's nothing to do with IT. It's a fundamental business concern. Any business manager should just know this. It's not a technical thing (well, it is... single point of failure, general risk) it's purely standard business knowledge. Really, it's just common sense. The whole system exists the way that it does to make sure you are never stuck with one company owning you.
LOL, well except that your registrar does if they decide not to place nice.. but hopefully they would be sued out of existence if that happened.
-
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
@coliver said in IoT devices Used in DDoS Attacks:
@Dashrender said in IoT devices Used in DDoS Attacks:
@scottalanmiller said in IoT devices Used in DDoS Attacks:
Ah, the cacheing failed from there? But they could move to another provider in, like, five minutes. Faster than the TTL on the records. That's not a viable DDoS vector as you just move.
Not if they buy their domain name from Dyn also.
You can purchase domain names from whomever it doesn't stop you from doing DNS from a different vendor or internally.
And it is insanely recommended that you never buy the domain from one and get DNS from the same one. Those two should never overlap. That's how you lose control of your systems.
Personally, I had never heard that until I saw your postings on SW. So while I understand this to be true now, I'm not sure where new IT persons would learn about it short of reading a post somewhere online. I suppose it could have been taught at ITT
It's not for you to have heard of. It's nothing to do with IT. It's a fundamental business concern. Any business manager should just know this. It's not a technical thing (well, it is... single point of failure, general risk) it's purely standard business knowledge. Really, it's just common sense. The whole system exists the way that it does to make sure you are never stuck with one company owning you.
LOL, well except that your registrar does if they decide not to place nice.. but hopefully they would be sued out of existence if that happened.
They don't have that option. It's a requirement of the process.
