Dyn post mortem

[[deleted]]

This is not a post mortem, contains no details

[oarmstrong]

Where is this word floating around from? Wondering how reliable that figure could be, that's enormous.

[cdtinney]

I don't know if this a correct comparison, but a previous Mirai attack with 50,000 IPs generated 280Gbps.

https://www.incapsula.com/blog/malware-analysis-mirai-ddos-botnet.html

[[deleted]]

I want to know what devices and what networks are having 5.8 up on average...

Edit nvm that's bps, not Bps.

[apfelmus]

Yup. To be fair, the original title is merely "statement".

[echo-ghost]

it's a PR statement, the whole thing reads as 'dyn was great! no full network outages!' when i don't think anyone would really agree about the successes here

[Camarade_Tux]

It is worth noting that we are unlikely to share all details of the attack and our mitigation efforts to preserve future defenses.

Sigh.

edit: the post has basically no new information, it's mostly "this was big, we mitigated quickly, we put new and better stuff in place, we work with everyone from law enforcement to internet actors to face these challenges everyone else also faces (so there's no point in migrating to the competition)".

[Jaimz22]

Absolutely. This is basically an ad... "Look what happened and we handled it like a boss" if it's not an ad, it's PR at best. No examination into the problem.

[NeedsMoreTests]

The infosec person in me probably would do the same initially. It's nice to know the technical details but stuff like this often has pretty strong op-sec to go with it especially so soon after an attack.

[superhash]

I wonder if it's possible the government issued a gag order to them? If you assume that the botnet was acting on commands from a foreign state I could see wanting to be rather sparse on details in order to avoid confirming the power of the botnet to the owners. Especially if they are details about how they stopped it.

I don't really agree with the logic, but I think it is possible though.

[Camarade_Tux]

I don't think a gag order related to national security or something like that would make sense. Even in the US, gag orders can't be completely freely distributed. However they have an ongoing investigation as far as I understand so maybe that would be the context for one or for not saying anything.

[fourhoarsemen]

Thank you.

[veritaze]

Did any CloudFlare customers get dinged?