2016 Dyn cyberattack
| File:Level3 Outage Map (US) - 21 October 2016.png | |
| Time | 11:10 – 13:20 UTC 15:50 – 17:00 UTC 20:00 – 22:10 UTC[2] |
|---|---|
| Date | October 21, 2016 |
| Location | Europe and North America, especially the Eastern United States |
| Type | Distributed denial-of-service |
| Participants | Unknown |
| Suspect(s) | New World Hackers, Anonymous (self-claimed) |
The 2016 Dyn cyberattack was a series of distributed denial-of-service attacks (DDoS attacks) on October 21, 2016, targeting systems operated by Domain Name System (DNS) provider Dyn. The attack caused major Internet platforms and services to be unavailable to large swathes of users in Europe and North America.[3][4] The groups Anonymous and New World Hackers claimed responsibility for the attack, but scant evidence was provided.[5]
As a DNS provider, Dyn provides to end-users the service of mapping an Internet domain name—when, for instance, entered into a web browser—to its corresponding IP address. The distributed denial-of-service (DDoS) attack was accomplished through numerous DNS lookup requests from tens of millions of IP addresses.[6] The activities are believed to have been executed through a botnet consisting of many Internet-connected devices—such as printers, IP cameras, residential gateways and baby monitors—that had been infected with the Mirai malware.
Contents
Timeline and impact
According to Dyn, a distributed denial-of-service (DDoS) attack began at 7:00 a.m. (EDT) and was resolved by 9:20 a.m. A second attack was reported at 11:52 a.m. and Internet users began reporting difficulties accessing websites.[7][8] A third attack began in the afternoon, after 4:00 p.m.[6][9] At 6:11 p.m., Dyn reported that they had resolved the issue.[10]
Affected services
Services affected by the attack included:
<templatestyles src="Div col/styles.css"/>
- Airbnb[11]
- Amazon.com[9]
- Ancestry.com[12][13]
- The A.V. Club[14]
- BBC[13]
- The Boston Globe[11]
- Box[15]
- Business Insider[13]
- CNN[13]
- Comcast[16]
- CrunchBase[13]
- DirecTV[13]
- The Elder Scrolls Online[13][17]
- Electronic Arts[16]
- Etsy[11][18]
- FiveThirtyEight[13]
- Fox News[19]
- The Guardian[19]
- GitHub[11][16]
- Grubhub[20]
- HBO[13]
- Heroku[21]
- HostGator[13]
- iHeartRadio[12][22]
- Imgur[23]
- Indiegogo[12]
- Mashable[24]
- National Hockey League[13]
- Netflix[13][19]
- The New York Times[11][16]
- Overstock.com[13]
- PayPal[18]
- Pinterest[16][18]
- Pixlr[13]
- PlayStation Network[16]
- Qualtrics[12]
- Quora[13]
- Reddit[12][16][18]
- Roblox[25]
- Ruby Lane[13]
- RuneScape[12]
- SaneBox[21]
- Seamless[23]
- Second Life[26]
- Shopify[11]
- Slack[23]
- SoundCloud[11][18]
- Squarespace[13]
- Spotify[12][16][18]
- Starbucks[12][22]
- Storify[15]
- Swedish Civil Contingencies Agency[27]
- Swedish Government[27]
- Tumblr[12][16]
- Twilio[12][13]
- Twitter[11][12][16][18]
- Verizon Communications[16]
- Visa[28]
- Vox Media[29]
- Walgreens[13]
- The Wall Street Journal[19]
- Wikia[12]
- Wired[15]
- Wix.com[30]
- WWE Network[31]
- Xbox Live[32]
- Yammer[23]
- Yelp[13]
- Zillow[13]
Investigation
The US Department of Homeland Security started an investigation into the attacks, according to a White House source.[3][33][34] No group of hackers claimed responsibility during or in the immediate aftermath of the attack.[35] Dyn's chief strategist said in an interview that the assaults on the company's servers were very complex and unlike everyday DDoS attacks.[8] Barbara Simons, a member of the advisory board of the United States Election Assistance Commission, said such attacks could affect electronic voting for overseas military or civilians.[8]
Dyn disclosed that, according to business risk intelligence firm FlashPoint and Akamai Technologies, the attack was a botnet coordinated through numerous Internet of Things-enabled (IoT) devices, including cameras, residential gateways, and baby monitors, that had been infected with Mirai malware. The attribution of the attack to the Mirai botnet had been previously reported by BackConnect Inc., another security firm.[36] Dyn stated that they were receiving malicious requests from tens of millions of IP addresses.[6][37] Mirai is designed to brute-force the security on an IoT device, allowing it to be controlled remotely.
Cybersecurity investigator Brian Krebs noted that the source code for Mirai had been released onto the Internet in an open-source manner some weeks prior, which made the investigation of the perpetrator more difficult.[38]
On 25 October 2016, US President Obama stated that the investigators still had no idea who carried out the cyberattack.[39]
On 13 December 2017, the Justice Department announced that three men (Paras Jha, 21, Josiah White, 20, and Dalton Norman, 21) had entered guilty pleas in cybercrime cases relating to the Mirai and clickfraud botnets.[40]
Perpetrators
In correspondence with the website Politico, hacktivist groups SpainSquad, Anonymous, and New World Hackers claimed responsibility for the attack in retaliation against Ecuador's rescinding Internet access to WikiLeaks founder Julian Assange, at their embassy in London, where he had been granted asylum.[5] This claim has yet to be confirmed.[5] WikiLeaks alluded to the attack on Twitter, tweeting "Mr. Assange is still alive and WikiLeaks is still publishing. We ask supporters to stop taking down the US internet. You proved your point."[41] New World Hackers has claimed responsibility in the past for similar attacks targeting sites like BBC and ESPN.com.[42]
On October 26, FlashPoint stated that the attack was most likely done by script kiddies.[43]
A November 17, 2016 Forbes article reported that the attack was likely carried out by "an angry gamer".[44]
See also
References
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 3.0 3.1 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 5.0 5.1 5.2 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 6.0 6.1 6.2 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 8.0 8.1 8.2 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 9.0 9.1 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 11.0 11.1 11.2 11.3 11.4 11.5 11.6 11.7 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 12.00 12.01 12.02 12.03 12.04 12.05 12.06 12.07 12.08 12.09 12.10 12.11 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 13.00 13.01 13.02 13.03 13.04 13.05 13.06 13.07 13.08 13.09 13.10 13.11 13.12 13.13 13.14 13.15 13.16 13.17 13.18 13.19 13.20 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 15.0 15.1 15.2 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 16.00 16.01 16.02 16.03 16.04 16.05 16.06 16.07 16.08 16.09 16.10 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 18.0 18.1 18.2 18.3 18.4 18.5 18.6 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 19.0 19.1 19.2 19.3 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 21.0 21.1 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 22.0 22.1 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 23.0 23.1 23.2 23.3 Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ 27.0 27.1 Joel Westerholm. "Så sänktes Twitter och Regeringen.se i attacken", Sveriges Radio, 24 October 2016. Retrieved 30 October 2016.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ CNN, 25 October 2016, Obama: We have no idea who carried out huge cyberattack
- ↑ Justice Department, 13 December 2017, Justice Department Announces Charges And Guilty Pleas In Three Computer Crime Cases Involving Significant Cyber Attacks
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
- ↑ Lua error in package.lua at line 80: module 'strict' not found.
 |
Wikimedia Commons has media related to October 2016 Dyn cyberattack. |
_-_21_October_2016.png){kind=link}