Dyn Cites Mirai Botnet as One Source of the Attack

In a statement regarding the DDoS attack on 10/21/2016, Dyn confirmed the sophisticated, highly distributed attack involved 10s of millions of IP addresses.

The company said its preliminary forensic analysis, with help of analysis from Flashpoint and Akamai, indicates that the attack originated across multiple attack vectors and internet locations. One source of the traffic for the attacks were devices infected by the Mirai botnet.  Dyn observed 10s of millions of discrete IP addresses associated with the Mirai botnet that were part of the attack.

http://hub.dyn.com/static/hub.dyn.com/dyn-blog/dyn-statement-on-10-21-2016-ddos-attack.html

Read More

Flashpoint Links Dyn DDoS Attack to Mirai IoT Botnet

Flashpoint confirmed that some of the infrastructure responsible for the distributed denial-of-service (DDoS) attacks against Dyn DNS were botnets compromised by Mirai malware.

Mirai botnets were previously used in DDoS attacks against security researcher Brian Krebs’ blog “Krebs On Security” and French internet service and hosting provider OVH. Mirai malware targets Internet of Things (IoT) devices like routers, digital video records (DVRs), and webcams/security cameras, enslaving vast numbers of these devices into a botnet, which is then used to conduct DDoS attacks. Flashpoint has confirmed that at least some of the devices used in the Dyn DNS attacks are DVRs, further matching the technical indicators and tactics, techniques, and procedures (TTPs) associated with previous known Mirai botnet attacks.

However, Flashpoint states that the Mirai botnets used in the October 21, 2016 attack against Dyn were separate and distinct botnets from those used to execute the DDoS attacks against “Krebs on Security” and OVH.

Flashpoint also notes that the Mirai source code was released earlier this month by the hacker operating the Mirai botnet responsible for the Krebs DDoS attack.

https://www.flashpoint-intel.com/mirai-botnet-linked-dyn-dns-ddos-attacks/

Read More

Dyn Managed DNS Hit by Major DDoS Attack

Dyn, which provides cloud-based Internet Performance Management and traffic steering to major websites, including Twitter, Zappos, Red Hat, BT, CNBC and Zillow, experienced a major DDoS was impacting its Managed DNS customers in its US East region.

On its status update site, Dyn noted that it began monitoring and mitigating a DDoS attack starting at 11:10 UTC on October 21st-Friday 2016 against its Dyn Managed DNS infrastructure.

Impacted websites and services included Etsy, Heroku, Business Insider, Soundcloud, Spotify, Reddit, Github, Twitter and others

The company reported that its services were restored to normal as of 13:20 UTC, approximately two hours after the attack began, but then new attacks emerged against the Dyn Managed DNS infrastructure.

https://www.dynstatus.com/incidents/nlr4yrr162t8

Read More