Massive attack combining compromised IoT devices, other bots cripples many sites.

The distributed denial of service attacks against dynamic domain name service provider Dyn this morning have now resurged. The attacks have caused outages at services across the Internet.

But this second wave of attacks appears to be affecting even more providers. According to Dale Drew, the chief security officer at Level 3 Communications, the attack is at least in part being mounted from a "botnet" of Internet-of-Things (IoT) devices.

Drew explained the attack in a Periscope briefing this afternoon. "We're seeing attacks coming from a number of different locations," Drew said. "An Internet of Things botnet called Mirai that we identified is also involved in the attack."

The botnet, made up of devices like home Wi-Fi routers and Internet protocol video cameras, is sending massive numbers of requests to Dyn's DNS service. Those requests look legitimate, so it's difficult for Dyn's systems to screen them out from normal domain name lookup requests.

Earlier this month, the code for the Marai botnet was released publicly. It may have been used in the massive DDoS attack against security reporter Brian Krebs. Marai and another IoT botnet called Bashlight exploit a common vulnerability in BusyBox, a pared-down version of the Linux operating system used in embedded devices. Marai and Bashlight have recently been responsible for attacks of massive scale, including the attack on Krebs, which at one point reached a traffic volume of 620 gigabits per second.

Matthew Prince, co-founder and CEO of the content delivery and DDoS protection service provider CloudFlare, said that the attack being used against Dyn is an increasingly common one. The attacks append random strings of text to the front of domain names, making them appear like new, legitimate requests for the addresses of systems with a domain. Caching the results to speed up responses is impossible.

Prince told Ars:

They're tough attacks to stop because they often get channeled through recursive providers. They're not cacheable because of the random prefix. We started seeing random prefix attacks like these three years ago, and they remain a very common attack. If IoT devices are being used, that would explain the size and scale [and how the attack] would affect: someone the size of Dyn.

Both Level 3 and CloudFlare have not directly been affected by the attack. But many of their customers have because of a reliance on Dyn's managed domain name services. The outages began this morning when Dyn reported a distributed denial of service affecting their US East Coast infrastructure.

While the first attack was apparently shrugged off by mid-morning, another wave hit about mid-day Eastern Time, again affecting sites and services that use Dyn as the provider of their authoritative Domain Name Service addresses. This took down parts of Twitter's network, as well as hundreds of other sites—including Github, Box, The Verge, Playstation Network, and personal webpage provider Wix—that rely on Dyn's service to dynamically reassign domain names to Internet addresses for traffic management purposes.

Prince added that Cloudflare was seeing a sizable increase in errors in traffic for its customers because the attack was affecting infrastructure providers like GitHub. "If a customer's site is pointing to a git there, now we can't reach Github," he said. "There are definitely infrastructure providers that we can't reach."

The attack itself is likely pointed at a Dyn customer rather than at Dyn itself. Some indications point to the attack focusing on Sony's Playstation domains, though Dyn has not confirmed this.

Ars will update this story as new information becomes available.

By: Arstechnica