{"id":13325,"date":"2016-10-26T16:59:25","date_gmt":"2016-10-26T20:59:25","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=13325"},"modified":"2019-11-15T06:52:14","modified_gmt":"2019-11-15T11:52:14","slug":"attack-on-dyn-explained","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/attack-on-dyn-explained\/13325\/","title":{"rendered":"How to not break the Internet"},"content":{"rendered":"<p>Perhaps the most striking point about last week\u2019s huge DDoS attack, which took down more than 80 big websites and online services, is that the criminals behind the attack accomplished it not by particularly sophisticated or cutting-edge means, but by creating a veritable army of consumer connected devices \u2014 what we call the Internet of Things (IoT). In this post we explain the critical concepts and how this incident is connected with every one of us.<\/p>\n<h3>The attack<\/h3>\n<p>On October 21, lots of Americans woke up to find some of their most popular websites were unavailable. No watching Netflix, no transacting business through PayPal, no online gaming with Sony PlayStation. And they couldn\u2019t even tweet about the problem \u2014 Twitter was down as well.<\/p>\n<p>In all, 85 major sites were either showing signs of stress or simply not responding at all.<\/p>\n<p>As it turned out, the underlying problem was a series of attacks \u2014 three in all \u2014 against the American Internet infrastructure. The first wave affected the East Coast. The second one affected users in California and the Midwest, as well as Europe. The third wave was mitigated by the efforts of <a href=\"https:\/\/en.wikipedia.org\/wiki\/Dyn_(company)\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Dyn<\/a>, the DNS service company that was the main target of all three attacks.<\/p>\n<p>Music services, media, and <a href=\"http:\/\/gizmodo.com\/this-is-probably-why-half-the-internet-shut-down-today-1788062835\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">many other<\/a> resources were affected. Amazon came in for special attention: a separate attack against it in Western Europe brought the site down for a while.<\/p>\n<h3>DNS and DDoS<\/h3>\n<p>So, how is it possible to disrupt so many sites with just three attacks? To understand this, you need to know what DNS is.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Can't get on a website? This is a live map, right now, of the massive DDoS attacks on Dyn's servers. It is creating many issues right now. <a href=\"https:\/\/t.co\/fekUqNgaL7\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/fekUqNgaL7<\/a><\/p>\n<p>\u2014 Flying With Fish (@flyingwithfish) <a href=\"https:\/\/twitter.com\/flyingwithfish\/status\/789524594017308672?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">October 21, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The Domain Name System, or DNS, is the system that hooks up your browser with the website you\u2019re looking for. Essentially, each site has digital address, a place where it lives, as well as a more friendly URL. For example, blog.kaspersky.com lives at the IP address 161.47.21.156.<\/p>\n<p>A DNS server works as an address book \u2014 it tells your browser at what digital location a site is stored. If a DNS server does not respond to a request, your browser won\u2019t know how to load the page. That\u2019s why DNS providers (especially major ones) form an important part of critical Internet infrastructure.<\/p>\n<p>That brings us to DDoS. A distributed-denial-of-service (DDoS) attack floods the servers that run a website or online service with requests until they collapse and the sites they serve stop working. For a DDoS attack, criminals need to send an enormous number of requests, and that\u2019s why they need a lot of devices to do it. For a DDoS attack, they usually use armies of hacked computers, smartphones, gadgets, and other connected things. Working together (but without their owners\u2019 knowledge or consent) these devices form <a href=\"https:\/\/www.kaspersky.com\/blog\/simda-botnet-check\/8304\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">botnets<\/a>.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Chinese manufacturer <a href=\"https:\/\/twitter.com\/hashtag\/recall?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#recall<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/IOT?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#IOT<\/a> gear following <a href=\"https:\/\/twitter.com\/hashtag\/Dyn?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Dyn<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/DDoS?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#DDoS<\/a> via <a href=\"https:\/\/twitter.com\/Mike_Mimoso?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Mike_Mimoso<\/a> <a href=\"https:\/\/t.co\/SQBo8adUIi\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/SQBo8adUIi<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/infosec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#infosec<\/a> <a href=\"https:\/\/t.co\/bCtqwuSRmm\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/bCtqwuSRmm<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/790657145268232192?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">October 24, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h3>Knocking out Dyn<\/h3>\n<p>So, you see how it all happened: Somebody used a giant botnet against Dyn. It included tens of millions of devices \u2014 IP cameras, routers, printers and other smart gadgets from the Internet of Things. They flooded Dyn\u2019s site with requests \u2014 a <a href=\"http:\/\/www.cbsnews.com\/news\/new-world-hackers-claims-responsibility-internet-disruption-cyberattack\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">claimed 1.2 terabits<\/a> per second. The <a href=\"http:\/\/ktla.com\/2016\/10\/22\/unprecedented-cyberattack-involved-tens-of-millions-of-ip-addresses\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">estimated damage<\/a> is about $110 million. However, the criminals responsible did not ask for ransom or make any other demands.<\/p>\n<p>In fact, they did nothing but attack, and they left no fingerprints. However, hacker groups New World Hackers and RedCult have claimed responsibility for the incident. In addition, RedCult promised to follow up with more attacks in the future.<\/p>\n<h3>Why should the average user care about this stuff?<\/h3>\n<p>Even if the Dyn incident did not affect you personally, that does not mean you did not take part in it.<\/p>\n<p>To create a botnet, criminals need a lot of devices with Internet connections. How many connected devices do you own? A phone, perhaps a smart TV, DVR, and webcam? Maybe a connected thermostat or refrigerator? Hacked gadgets serve two masters at the same time: For their owners, they work as usual, but they also attack websites at a criminal\u2019s command. Millions of such devices took down Dyn.<\/p>\n<p>This gigantic botnet was created with the help of Mirai malware. The malware\u2019s action is rather simple: It scans for IoT devices and tries a password on whatever it finds. Usually people do not change their gadgets\u2019 default settings and passwords, so the devices are easy to hack \u2014 that\u2019s how they get conscripted into the zombified armies of Mirai and similar malware.<\/p>\n<p>And that means that your connected TV could be a part of botnet, and you\u2019d never know it.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">A timely reminder: These 60 dumb passwords can hijack over 500,000 IoT devices into the Mirai botnet <a href=\"https:\/\/t.co\/RgjgRIJFy8\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/RgjgRIJFy8<\/a><\/p>\n<p>\u2014 Graham Cluley (@gcluley) <a href=\"https:\/\/twitter.com\/gcluley\/status\/790621888842199040?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">October 24, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>In September of this year somebody <a href=\"https:\/\/krebsonsecurity.com\/2016\/09\/krebsonsecurity-hit-with-record-ddos\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">used<\/a> Mirai to take down the blog of IT security journalist Brian Krebs, overwhelming the server with requests from 380,000 zombified devices at up to 665 gigabits per second. The provider tried hold the line but eventually gave up. The blog started working again only after Google intervened to protect it.<\/p>\n<p>Soon after that attack, a user going by the pseudonym Anna-senpai published the Mirai source code on an underground forum. Criminals of all stripes grabbed it at once. Since then, the number of Mirai bots has increased constantly; the Dyn attack occurred after less than a month.<\/p>\n<h3>Implicating the IoT<\/h3>\n<p>DDoS is a <a href=\"https:\/\/www.hackread.com\/ovh-hosting-suffers-1tbps-ddos-attack\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">very<\/a> <a href=\"https:\/\/krebsonsecurity.com\/2016\/09\/krebsonsecurity-hit-with-record-ddos\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">popular<\/a> type of attack. And using smart devices in such attacks is appealing for criminals \u2014 as we\u2019ve already <a href=\"https:\/\/www.kaspersky.com\/blog\/internet-of-things-and-cybersecurity-of-infrastructure\/8088\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">mentioned<\/a>, the Internet of Things is <a href=\"https:\/\/www.kaspersky.com\/blog\/surviving-iot\/10480\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">buggy<\/a> and <a href=\"https:\/\/www.kaspersky.com\/blog\/iot-state-of-mind\/11577\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">vulnerable<\/a>. That is not likely to change in anytime soon.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">How will the Internet of Things affect cybersecurity? \u2013 <a href=\"http:\/\/t.co\/fWScmf4QfQ\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/fWScmf4QfQ<\/a> <a href=\"http:\/\/t.co\/sAk1mcZPg5\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/sAk1mcZPg5<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/586174972156108800?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 9, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Developers of smart gadgets do little to secure their devices and don\u2019t explain to users that they should change the passwords on cameras, routers, printers, and other devices. In fact, not all of them even <em>allow<\/em> users to do so. That makes IoT devices perfect targets.<\/p>\n<p>Today somewhere between 7 and 19 billion devices <a href=\"https:\/\/www.theguardian.com\/technology\/2016\/oct\/22\/city-banks-plan-to-hoard-bitcoins-to-help-them-pay-cyber-ransoms\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">are connected<\/a> to the World Wide Web. According to conservative estimates, that figure will reach 30\u201350 billion in the next five years. Almost certainly, the majority of these devices will not be powerfully protected. In addition, gadgets compromised by Mirai are still active \u2014 and new ones join its army of bots every day.<\/p>\n<h3>What about the longer term?<\/h3>\n<p>Criminals often use botnets to attack <a href=\"https:\/\/www.kaspersky.com\/blog\/industrial-vulnerabilities\/12596\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">core industrial infrastructure <\/a>\u2014 <a href=\"http:\/\/www.news.com.au\/technology\/online\/hacking\/hackers-send-half-of-the-homes-in-ukraines-ivanofrankivsk-region-into-darkness\/news-story\/6e7fb4b8dc576f0ececfdd6bcb8d1b69\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">electrical substations<\/a>, <a href=\"http:\/\/www.securityweek.com\/attackers-alter-water-treatment-systems-utility-hack-report\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">water utilities<\/a>, and yes, DNS providers. Security researcher Bruce Schneier <a href=\"http:\/\/www.securityweek.com\/attackers-alter-water-treatment-systems-utility-hack-report\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">observes and opines<\/a> that somebody is \u201clearning how to take down the Internet\u201d with the help of powerful and continuous DDoS attacks.<\/p>\n<p>Botnets are getting bigger, and when those attack-tests are finished, it\u2019s not unreasonable to believe a full-scale attack will start. Imagine dozens of simultaneous attacks as powerful as the Dyn incident was and you\u2019ll understand what damage can be done. Entire countries could lose their Internet.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">The <a href=\"https:\/\/twitter.com\/hashtag\/Mirai?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Mirai<\/a> botnet has recruited nearly 500,000 <a href=\"https:\/\/twitter.com\/hashtag\/IoT?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#IoT<\/a> devices since its source code was released \u2013 <a href=\"https:\/\/t.co\/m8ooWKrjph\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/m8ooWKrjph<\/a><\/p>\n<p>\u2014 Threatpost (@threatpost) <a href=\"https:\/\/twitter.com\/threatpost\/status\/788736768455639040?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">October 19, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h3>How not to become a part of botnet<\/h3>\n<p>One person cannot stop botnets from crashing the Internet \u2014 but together we can do a lot by not joining a botnet. You can start with making your devices more secure so that Mirai and similar malware can\u2019t take control of them. If everyone did that, botnet armies would shrink into insignificance.<\/p>\n<p>To stop your printer, router, or refrigerator from plunging the world into Internet darkness, take these simple precautions.<\/p>\n<p>1. Make sure you don\u2019t leave\u00a0default passwords on your devices.\u00a0Use <a href=\"https:\/\/www.kaspersky.com\/blog\/false-perception-of-it-security-passwords\/7036\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">reliable combinations<\/a> that cannot be brute forced easily.<\/p>\n<p>2. Update firmware for all of your gadgets \u2014 especially the older ones \u2014 if possible.<\/p>\n<p>3. Be selective in choosing smart devices. Ask yourself: Does this really need an Internet connection? If the answer is \u201cYes!\u201d then take the time to read about the device options before buying. If you discover that it has hard-coded passwords, choose a different model.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An unwitting army of connected devices caused an insane disruption of major Internet sites. IoT users need to wise up.<\/p>\n","protected":false},"author":522,"featured_media":13326,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2683],"tags":[1027,756,93,1058,1134,658,794,187,97],"class_list":{"0":"post-13325","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-connected-devices","10":"tag-critical-infrastructure","11":"tag-cybercriminals","12":"tag-ddos","13":"tag-internet","14":"tag-internet-of-things","15":"tag-iot","16":"tag-passwords","17":"tag-security-2"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/attack-on-dyn-explained\/13325\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/attack-on-dyn-explained\/5641\/"},{"hreflang":"ar","url":"https:\/\/me.kaspersky.com\/blog\/attack-on-dyn-explained\/3940\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/attack-on-dyn-explained\/7925\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/attack-on-dyn-explained\/7867\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/attack-on-dyn-explained\/7901\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/attack-on-dyn-explained\/9420\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/attack-on-dyn-explained\/9237\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/attack-on-dyn-explained\/13471\/"},{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/attack-on-dyn-explained\/2629\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/attack-on-dyn-explained\/6240\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/attack-on-dyn-explained\/6764\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/attack-on-dyn-explained\/5587\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/attack-on-dyn-explained\/9074\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/attack-on-dyn-explained\/13047\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/attack-on-dyn-explained\/13471\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/attack-on-dyn-explained\/13325\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/attack-on-dyn-explained\/13325\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/security-2\/","name":"security"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/13325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/522"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=13325"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/13325\/revisions"}],"predecessor-version":[{"id":30113,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/13325\/revisions\/30113"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/13326"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=13325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=13325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=13325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}