2016DDoS
Dyn DNS DDoS (Mirai botnet)
21 October 2016
A large distributed denial of service attack hit Dyn's DNS infrastructure in waves, making many popular websites hard to reach for users in parts of the US and Europe. Much of the traffic came from internet-of-things devices such as cameras and recorders infected with Mirai, which had been released publicly weeks earlier.
- Victim
- Dyn, a managed DNS provider, and the websites that relied on it
- Sector
- Internet infrastructure
- Public attribution
- Dyn identified Mirai-infected devices in the attack traffic. The authors of Mirai pleaded guilty to US charges in 2017; the Department of Justice announcement does not charge them with the Dyn attack.
- Malware
- Mirai
Impact
Many major websites that used Dyn for DNS were unreachable or slow for hours (Dyn).
Root cause
Large numbers of IoT devices exposed to the internet with default credentials, and heavy reliance by many services on a single DNS provider.
Lessons learned: the controls it teaches
- Avoid single points of failure: use more than one DNS provider for critical services.
- Change default credentials and disable remote management on IoT devices.
- Have DDoS mitigation and upstream provider contacts ready before an attack.