Spark DNS Issues - Amazing - Broadband Service Alert

Forums › Spark New Zealand (including Skinny and BigPipe) › Spark DNS Issues - Amazing - Broadband Service Alert

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | ... | 21

314 posts

Ultimate Geek
+1 received by user: 10

#1123033 6-Sep-2014 12:24

Something doesn't add up.

an ADSL, or VDSL modem doesn't have the capability to take down a whole network, obviously Spark know something, they aren't letting up.

If that was the case, why don't they just shut off their internet access, till someone sends a tech over, to have it resolved.

Something about their story doesn't add up.

I recon the GCSB, and FBI would need to look into this, as if this had to happen in any other country, the results would be catastrophic.

Talkiet

4819 posts

Uber Geek
+1 received by user: 3934

Trusted

#1123049 6-Sep-2014 12:32

I don't have time to respond to everything here but...

- It's a DNS amplification attack, it doesn't need much of a footprint to have a big impact
- People (many) are working on multiple streams to mitigate and fix

Suggesting the GSCB or FBI look into this I can only assume is an attempt at humour.

Cheers - N

Please note all comments are from my own brain and don't necessarily represent the position or opinions of my employer, previous employers, colleagues, friends or pets.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1123050 6-Sep-2014 12:33

PaulZA: Something doesn't add up. an ADSL, or VDSL modem doesn't have the capability to take down a whole network, obviously Spark know something, they aren't letting up. If that was the case, why don't they just shut off their internet access, till someone sends a tech over, to have it resolved.

Something about their story doesn't add up. I recon the GCSB, and FBI would need to look into this, as if this had to happen in any other country, the results would be catastrophic.

There is absolutely nothing at all in this story that doesn't stack up. What is happening is very, very real, and is being caused by infected machines.

I'll be brutally honest and say that anybody who doesn't believe it has never had any first hand experience of modern day amplification attack.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1123052 6-Sep-2014 12:34

eXDee:
IMO when you're experiencing a degradation of service of this magnitude, you want to make sure you're communicating the right messages, and helping people with workarounds if appropriate.

'

Yip, and that's certainly not happening right now.

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1123056 6-Sep-2014 12:38

sbiddle:

PaulZA: Something doesn't add up. an ADSL, or VDSL modem doesn't have the capability to take down a whole network, obviously Spark know something, they aren't letting up. If that was the case, why don't they just shut off their internet access, till someone sends a tech over, to have it resolved.

Something about their story doesn't add up. I recon the GCSB, and FBI would need to look into this, as if this had to happen in any other country, the results would be catastrophic.

There is absolutely nothing at all in this story that doesn't stack up. What is happening is very, very real, and is being caused by infected machines and/or routers.

I'll be brutally honest and say that anybody who doesn't believe it has never had any first hand experience of modern day amplification attack.

myopinion

939 posts

Ultimate Geek
+1 received by user: 112

#1123060 6-Sep-2014 12:48

Same issue here in Pukekohe. 8.8.8.8 fixes it. Took a while to figure out why my iPad worked but not my computers. Then I realised I was using unotelly DNS! Doh.

Dyson

Shop now for Dyson appliances (affiliate link).

old3eyes

9158 posts

Uber Geek
+1 received by user: 1364

Subscriber

#1123064 6-Sep-2014 12:58

I wonder if this "malware" attack is why since 10.00am I've received about 70 returned emails saying can't be delivered to intended receipt. Had a look at some of them and they appear random email addresses to US URLs.

Regards,

Old3eyes

Bobdn

222 posts

Master Geek
+1 received by user: 68

#1123065 6-Sep-2014 12:58

khull: Have had enough with this, moving back to Snap

I may be going out on a limb here, but do you do a lot of rage quitting when playing Call of Duty?

eXDee

4033 posts

Uber Geek
+1 received by user: 1070

Trusted

#1123079 6-Sep-2014 13:11

PaulZA: Something doesn't add up. an ADSL, or VDSL modem doesn't have the capability to take down a whole network, obviously Spark know something, they aren't letting up. If that was the case, why don't they just shut off their internet access, till someone sends a tech over, to have it resolved.

Something about their story doesn't add up. I recon the GCSB, and FBI would need to look into this, as if this had to happen in any other country, the results would be catastrophic.

Read this and you might understand better what's going on.
http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack

and

http://arstechnica.com/information-technology/2013/03/how-spamhaus-attackers-turned-dns-into-a-weapon-of-mass-destruction/

mattwnz

20519 posts

Uber Geek
+1 received by user: 4797

#1123089 6-Sep-2014 13:21

The problem started late last night as I was having problems then. So if they only saw it this morning it took them quite a long time to identify it.

Coil

6614 posts

Uber Geek
+1 received by user: 2153
Inactive user

#1123090 6-Sep-2014 13:24

old3eyes: I wonder if this "malware" attack is why since 10.00am I've received about 70 returned emails saying can't be delivered to intended receipt. Had a look at some of them and they appear random email addresses to US URLs.

Your PC just has malware or a virus.

Lenovo

Shop now for Lenovo laptops and other devices (affiliate link).

RunningMan

9187 posts

Uber Geek
+1 received by user: 4840

#1123093 6-Sep-2014 13:28

mattwnz: The problem started late last night as I was having problems then. So if they only saw it this morning it took them quite a long time to identify it.

Talkiet: [snip] As many have worked out (and I just got off a technical audio about the issue), this is a DNS amplification attack and we have had people working all night trying to mitigate the issue as best we can.

Nope, they've been trying to resolve it all night.

old3eyes

9158 posts

Uber Geek
+1 received by user: 1364

Subscriber

#1123099 6-Sep-2014 13:37

TimA:
old3eyes: I wonder if this "malware" attack is why since 10.00am I've received about 70 returned emails saying can't be delivered to intended receipt. Had a look at some of them and they appear random email addresses to US URLs.

Your PC just has malware or a virus.

Ran both NOD 32 and Megabytes. Nothing found.. I find also now I Can't send emails from my Orcon account using port 587 to mail.orcon.net.nz. . Get a 451 temporary error. Pleaze try later..

Regards,

Old3eyes

sbiddle

30853 posts

Uber Geek
+1 received by user: 9996

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#1123106 6-Sep-2014 13:43

mattwnz: The problem started late last night as I was having problems then. So if they only saw it this morning it took them quite a long time to identify it.

They've been trying to identify and disconnect affected customers since last night.

I just don't think people understand the complexity, or the scale of such an attack.

mcraenz

1140 posts

Uber Geek
+1 received by user: 222

#1123112 6-Sep-2014 13:54

I wonder if this is a paid attack by a competitor who wants to discredit Spark at what might be seen as a critical time for them as they rebrand/relaunch.

Help me build a better way of doing politics in Aotearoa New Zealand

political.nz

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | ... | 21