3 ms·

Trying to inform oneself about a technical matter through a mainstream news source is an exercise in frustration. Maybe my English needs work. Could someone wi

Trying to inform oneself about a technical matter through a mainstream news source is an exercise in frustration. Maybe my English needs work. Could someone with superior English skills to mine, please decipher the article and tell me: Is there any actual evidence of an attack? Has traffic spiked through/from NK? Or could this be them "pulling the plug"? Because the first case is: "Someone attacked NK Internet and brought it down", while the second "NK Internet IPs were \"withdrawn\" from the net".

BorisMelnik 12y ago
as far as I can tell (from one read of the post) the internet is down. I did not see any sort of quote from a network security analyst from a neutral party analyzing packets or saying it was a DDoS. It is not the style of DPNK for them to pull the plug, that would make them appear weak to the outside world when in fact they did invent the internet and have superior everything on everything.
- yourad_io 12y ago
  > It is not the style of DPNK for them to pull the plug, that would make them appear weak to the outside world when in fact they did invent the internet and have superior everything on everything. You misunderstand. They broke backwards compatibility with our puny Internet v1. It's progress, baby ;)
oasisbob 12y ago
Dyn Research (née Renesys) was quoted in the article, and typically posts in-depth articles when this type of thing happens. [1] Based on the quote[2], I interpret the failure as someone attacking the routers themselves, overwhelming their control planes to the point where they can't sustain BGP sessions reliably. [1] No post from them yet, would expect it to be at http://research.dyn.com/2014/12/ http://research.dyn.com/2014/12/ if/when they do the full write-up. [2] "Their networks are under duress,” Mr. Madory said. “This is consistent with a DDoS attack on their routers,” he said, referring to a distributed denial of service attack, in which attackers flood a network with traffic until it collapses under the load."
- yourad_io 12y ago
  I did see that, but it didn't quite measure up to a legitimate data point. "under duress" clearly states that there is "duress", but "consistent with" is somewhat conjecture-y. If that is a verbatim quote, then Dyn is telling is that there was an attack (duress involved, no ifs buts or maybes). If that quote has been altered even slightly[1], we're back to "NK won't pick up the phone no more"[2]. [1] Any of these would remove the "attack" edge of this: Their networks... * seem to be under duress * (seem to be/are) down/nonresponsive [2] but we don't know if someone blew up the switchboard, or if they switched it off themselves.
- hhw 12y ago
  If routers are being directly attacked, the router IPs can just be null routed, as they don't need to be reachable by the Internet at large to be the next hop for passing traffic between routers. Some networks use unadvertised IP space for their router point-to-point and loopback IPs for that reason. Guess it's not too surprising that North Korea doesn't have better network engineers.
hn_user2 12y ago
Yeah I caught that too. I interpreted the withdrawn to mean that they stopped advertising any routes for their ip block via BGP. Which could be a pulled plug or a DDOS. I think most likely a DDOS by a random party, but doesn't sound like much actual evidence to any specifics.
- yourad_io 12y ago
  > I think most likely a DDOS by a random part Agreed, but I would think a DDOS would be observable from the neighbouring (and even not-so-neighbouring) networks/systems. Reporting an attack based on Dyn saying "under duress/consistent with DDOS" is just shitty, shitty journalism.
lmm 12y ago
Post from Dyn Research up now. They make the point that the failure happened gradually, after hours of instability - so it's consistent with a DDOS or a hardware failure in the routers, but not with someone "pulling the plug" or a cable being cut.
yourad_io 12y ago
Now that the actual source (Dyn) put up their work: > Who caused this, and how? A long pattern of up-and-down connectivity, followed by a total outage, seems consistent with a fragile network under external attack. But it’s also consistent with more common causes, such as power problems. Point causes such as breaks in fiberoptic cables, or deliberate upstream provider disconnections, seem less likely because they don’t generate prolonged instability before a total failure. We can only guess. The data themselves don’t speak to motivations, or distinguish human factors from physical infrastructure problems. [1] ...it turns out that the DDOS part was indeed pure conjecture and over-hyped BS. Thanks, NY times. Also, they changed the title of the article, if not more. Classy. [1] http://research.dyn.com/2014/12/who-disconnected-north-korea/ http://research.dyn.com/2014/12/who-disconnected-north-korea...

BorisMelnik 12y ago

as far as I can tell (from one read of the post) the internet is down. I did not see any sort of quote from a network security analyst from a neutral party analyzing packets or saying it was a DDoS. It is not the style of DPNK for them to pull the plug, that would make them appear weak to the outside world when in fact they did invent the internet and have superior everything on everything.

yourad_io 12y ago
> It is not the style of DPNK for them to pull the plug, that would make them appear weak to the outside world when in fact they did invent the internet and have superior everything on everything. You misunderstand. They broke backwards compatibility with our puny Internet v1. It's progress, baby ;)

oasisbob 12y ago

Dyn Research (née Renesys) was quoted in the article, and typically posts in-depth articles when this type of thing happens. [1] Based on the quote[2], I interpret the failure as someone attacking the routers themselves, overwhelming their control planes to the point where they can't sustain BGP sessions reliably. [1] No post from them yet, would expect it to be at http://research.dyn.com/2014/12/ http://research.dyn.com/2014/12/ if/when they do the full write-up. [2] "Their networks are under duress,” Mr. Madory said. “This is consistent with a DDoS attack on their routers,” he said, referring to a distributed denial of service attack, in which attackers flood a network with traffic until it collapses under the load."

yourad_io 12y ago
I did see that, but it didn't quite measure up to a legitimate data point. "under duress" clearly states that there is "duress", but "consistent with" is somewhat conjecture-y. If that is a verbatim quote, then Dyn is telling is that there was an attack (duress involved, no ifs buts or maybes). If that quote has been altered even slightly[1], we're back to "NK won't pick up the phone no more"[2]. [1] Any of these would remove the "attack" edge of this: Their networks... * seem to be under duress * (seem to be/are) down/nonresponsive [2] but we don't know if someone blew up the switchboard, or if they switched it off themselves.
hhw 12y ago
If routers are being directly attacked, the router IPs can just be null routed, as they don't need to be reachable by the Internet at large to be the next hop for passing traffic between routers. Some networks use unadvertised IP space for their router point-to-point and loopback IPs for that reason. Guess it's not too surprising that North Korea doesn't have better network engineers.

hn_user2 12y ago

Yeah I caught that too. I interpreted the withdrawn to mean that they stopped advertising any routes for their ip block via BGP. Which could be a pulled plug or a DDOS. I think most likely a DDOS by a random party, but doesn't sound like much actual evidence to any specifics.

yourad_io 12y ago
> I think most likely a DDOS by a random part Agreed, but I would think a DDOS would be observable from the neighbouring (and even not-so-neighbouring) networks/systems. Reporting an attack based on Dyn saying "under duress/consistent with DDOS" is just shitty, shitty journalism.

lmm 12y ago

Post from Dyn Research up now. They make the point that the failure happened gradually, after hours of instability - so it's consistent with a DDOS or a hardware failure in the routers, but not with someone "pulling the plug" or a cable being cut.

yourad_io 12y ago

Now that the actual source (Dyn) put up their work: > Who caused this, and how? A long pattern of up-and-down connectivity, followed by a total outage, seems consistent with a fragile network under external attack. But it’s also consistent with more common causes, such as power problems. Point causes such as breaks in fiberoptic cables, or deliberate upstream provider disconnections, seem less likely because they don’t generate prolonged instability before a total failure. We can only guess. The data themselves don’t speak to motivations, or distinguish human factors from physical infrastructure problems. [1] ...it turns out that the DDOS part was indeed pure conjecture and over-hyped BS. Thanks, NY times. Also, they changed the title of the article, if not more. Classy. [1] http://research.dyn.com/2014/12/who-disconnected-north-korea/ http://research.dyn.com/2014/12/who-disconnected-north-korea...