The Aftermath of the Dyn DDOS Attack

Abstract

Nobody knows who organized the attack. The program hijacked many cameras and home devices, and redirected them to engineer a series of distributed denial of server (DDOS) attacks on a few hours apart, all on 21 October 2016. By executing this novel and rather clever hijack of many devices for a DDOS attack, the attack exposed an important vulnerability in today's internet. The attack contains one other element. It aimed at Dyn, who acts as a name resolver. Dyn enables Internet traffic by translating the site's domain name (URL) into the IP address where the server behind that domain is to be found. During the later phases of the attack, Dyn servers were unable to process users' requests, and as a result, users lost access to web domains contracting with Dyn, such as Netflix, CNBC, and Twitter. Other well-known firms also were disabled, such as Airbnb, Etsy, Play Station Network, and Wikia. This article focuses on the aftermath of this event, which did not get headlines, but illustrates an important features of the situation. Specifically, how did users react? User behavior tells us something about the challenges facing suppliers, and in this case, it tells us about a basic challenge in network security today. It will take a bit of work to appreciate the lesson, and, let me tip my hand, the news is not good. The article provides a summary of a longer study done by a group of my colleagues and myself.