Archive for Technology

Apple will require HTTPS connections for iOS apps by the end of 2016

 

apple_topic

During a security presentation at Apple’s Worldwide Developers’ Conference, the company revealed the deadline for all apps in its App Store to switch on an important security feature called App Transport Security — January 1, 2017.

“Today, I’m proud to say that at the end of 2016, App Transport Security is becoming a requirement for App Store apps,” Apple’s head of security engineering and architecture, Ivan Krstic, said during a WWDC presentation. “This is going to provide a great deal of real security for our users and the communications that your apps have over the network.”

App Transport Security, or ATS, is a feature that Apple debuted in iOS 9. When ATS is enabled, it forces an app to connect to web services over an HTTPS connection rather than HTTP, which keeps user data secure while in transit by encrypting it.

The “S” in HTTPS helpfully stands for secure and you’ll often see it appear in your browser when logging into your banking or email accounts. But mobile apps often aren’t as transparent with users about the security of their web connections, and it can be hard to tell whether an app is connecting via HTTP or HTTPS.

Enter ATS, which is enabled by default for iOS 9. However, developers can still switch ATS off and allow their apps to send data over an HTTP connection — until the end of this year, that is. (For technical crowd: ATS requires TLS v 1.2, with exceptions for already encrypted bulk data, like media streaming.)

At the end of 2016, Apple will make ATS mandatory for all developers who hope to submit their apps to the App Store. App developers who have been wondering when the hammer would drop on HTTP can rest a little easier now that they have a clear deadline, and users can relax with the knowledge that secure connections will be forced in all of the apps on their iPhones and iPads.

In requiring developers to use HTTPS, Apple is joining a larger movement to secure data as it travels online. While the secure protocol is common on login pages, many websites still use plain old HTTP for most of their connections. That’s slowly changing as many sites make the arduous transition to HTTPS (Wired has been particularly good at documenting the process).

[techcrunch.com]

How to remove all old posts from your Facebook Timeline

fb

Facebook is notoriously bad for reminding you of the things you’ve posted in the past.

If you’re like me, you probably have quite a few posts lurking in the dark history of your Timeline that you completely forgot about. It’s time to delete those from once and for all, and I’m going to show you how.

Timeline check-up

First and foremost, make sure you know what your Timeline looks like to public users (anyone who is not your Facebook friend). To do this, go to your Timeline, click on the three dots to the right of the Activity Log button, choose “View as…,” and you should see this:

Take a good look through, and anything you don’t like, click on the date under your name, click on the little globe icon, and change “Public” to “Friends,” “Only Me,” or “Custom.” Alternatively, you can delete the post completely by clicking on the ‘X’ button.

Hide old Public posts

If you have lots of Public posts that you want to hide, believe it or not, Facebook has a tool for that. This is the best way to fix the issue you’ve been experiencing today.

Click on the security lock in the top-right on Facebook, choose ‘See More Settings’, and click on Limit Past Posts. You should see the following message popup; click on the blue “Limit Old Posts” button to change the visibility of all your old posts to just “Friends”:

Fix your Timeline settings

Next up, let’s make sure your Timeline settings are what you want them to be. Once again, click on the security lock in the top-right on Facebook and click on Timeline and Tagging Settings in the left pane.

Make sure the first, fourth, fifth and seventh options are set to “Friends,” or whatever you personally prefer:

Deep Facebook cleaning

If these tips didn’t do the trick for your yet, there’s also the option to work with a Chrome extension like Facebook Post Manager. However, these tend to be a little bit aggressive — so watch out when you’re using them.

There you go — that’s it!

You’ve cleaned your Facebook Timeline from old, forgotten posts. You can now go on and live your life without having to worry someone runs into an embarrassing picture or status update from 2009.

credit: thenextweb.com

Yahoo admits employees discovered hack in 2014

yahoo

 

Yahoo admitted today that some of its employees were aware of the theft of 500 million users’ data as early as 2014 — years before Yahoo publicly acknowledged the hack.

The hack, which Yahoo has attributed to an unnamed “state-sponsored actor,” occurred in late 2014, and according to today’s filing with the Securities and Exchange Commission, it seems Yahoo detected it early on.

“In late July 2016, a hacker claimed to have obtained certain Yahoo user data. After investigating this claim with the assistance of an outside forensic expert, the Company could not substantiate the hacker’s claim. Following this investigation, the Company intensified an ongoing broader review of the Company’s network and data security, including a review of prior access to the Company’s network by a state-sponsored actor that the Company had identified in late 2014,” Yahoo said in the filing.

Yahoo also reported that 23 consumer class action lawsuits have been filed in response to the breach, but that it’s too early to estimate monetary damages. It estimates the hack has led to a loss of $1 million so far.

The question of when Yahoo learned of the breach is essential to its planned sale to Verizon. Verizon has reportedly asked for a $1 billion discount in light of the breach, which was not disclosed until after the September sale even though Yahoo CEO Marissa Mayer allegedly learned of the breach in July. (Disclosure: Verizon owns TechCrunch.)

In today’s filing, Yahoo says it has formed an independent committee to review “the scope of knowledge within the Company in 2014 and thereafter regarding this access, the Security Incident, the extent to which certain users’ account information had been accessed.”

Senator Mark Warner has asked the SEC to investigate what Yahoo knew about the breach and when it knew it, citing an earlier Yahoo filing that claimed the company was not aware of any security breaches. “Yahoo’s September filing asserting lack of knowledge of security incidents involving its IT systems creates serious concerns about truthfulness in representations to the public,” Warner said in a statement.

Source: Techcrunch

Microsoft will make Windows 10 updates 35 percent smaller

en-intl-l-windows-10-home-kw9-00265-rm2-mnco

 

Updating Windows takes forever, and it seems like Windows 10 gets one every other day. But now Microsoft is going to make the update process much less painful with the new ‘Unified Update Platform‘ (UUP), starting by making downloads a lot smaller.

Basically, Windows will now only download the portion the updates you need since your most recent build using something called differential downloads. By cutting out much of the bloat, Microsoft says you can expect download sizes to decrease by approximately 35 percent with the update.

Meanwhile, Microsoft says its also reducing the amount of data set to client devices (particularly important for Mobile). Also speaking of mobile, Windows 10 phones and tablets will no longer have to update multiple times just to get the latest features if you’re a couple of builds behind.

Keep in mind nothing is changing about the update process on the user end; they will look the same as they always have, except  faster.

The feature is being tested out with Insiders first, and is currently set to reach general availability with the upcoming Windows 10 Creators Update.

Introducing Unified Update Platform on Windows Blog

Vodacom Tanzania offers free online services to subscribers

vodacom_shop_1_lrg

 

VODACOM has partnered with Facebook to provide free access to online services to its customers. The cellular telephone company said in a statement that its subscribers with smartphones will be able to access Facebook and a variety of key websites free of charge.

“The Facebook for free service is for all Vodacom customers, including prepaid, post-paid and hybrid, provided that their mobile phones are data-enabled,” the statement partly reads.The service would not require subscription and customers’ phones would default to Vodacom’s Facebook for free, it said, adding that would apply to even customers with zero airtime balance.It, however, cautioned that some elements on Facebook would not be accessed free of charge as data charges would apply for uploading and watching videos and browsing external links (websites) clicked from Facebook, as well as videos from external links, such as YouTube videos.Data charges will also be applicable for watching videos, as well as making voice calls on Facebook Messenger. 

Twitter Is Shutting Down Its Vine Video App

vine

Vine, the 3-year-old app that rose to popularity for its six-second video clips, is being shuttered.

Twitter, which acquired Vine in 2012 before the app had even launched, announced Thursday morning that it would be discontinuing the app in the coming months.

Over the years, Vine became especially popular with a growing creative community and gave rise to a new class of online stars, Viner, that included Andrew Bachelor, Cameron Dallas, Nash Grier and others. Many of the most popular videos were comedic, featured musical performances or used heavy editing techniques.

Twitter has offered little information about the size and growth of the app. But in recent years, many of Vine’s top creators have abandoned the app — which did not offer an avenue for generating revenue from their large audiences — for more economically viable platforms, like YouTube and Instagram.

Earlier this year, Twitter announced that it would let some users post longer videos (clips up to 140 seconds) on Vine. It also started to make moves to offer revenue-sharing opportunities for creators.

In a blog post on Medium, Twitter said that it would give users an opportunity to access and download their Vines before the service shuts down. It also said it would keep the website up online.

“To all the creators out there — thank you for taking a chance on this app back in the day,” the company wrote in a blog post on Medium.

One of Vine’s original founders, Rus Yusupov, tweeted in response to the news: “Don’t sell your company!”

The news comes just hours after Twitter announced during its third quarter earnings that it would be letting go 9 percent of its staff, or about 350 positions, as it looks to cut costs amid slowing growth.

Car thieves stopped in their tracks

By Louis Kolumbia

Dar es Salaam. Social media has once again demonstrated its significant power in helping to avert crime and bring culprits to book after a WhatsApp post on Sunday helped one Captain Innocent Dallu to recover his stolen car that had his three-year-old daughter on board.

Captain Dallu of the Tanzania People’s Defence Forces, went through an ordeal that lasted 12 hours and when it was over, he thanked God and testified his appreciation of the power of the social made in playing a crucial part in fighting crime.

“The public should wisely use social media because in addition to helping people network and be closer, it can play a crucial role in the provision of key information for the betterment of the society,” he said.

How the incident unfolded

At around midday on Sunday, Capt Dallu parked his Toyota Harrier with Registration Number T400 DEH outside a shopping mall at the Mbezi Beach suburb in Dar es Salaam and left his children inside the car; a boy aged seven and a girl aged three. He walked into the mall to make some quick purchases. He left the engine running to provide air conditioning for the children.

When he went back to the car noted it was gone with the little girl still on board while the seven-year was left stranded outside the mall.

Speaking to The Citizen in a telephone interview yesterday, Capt Dallu, a medical doctor currently serving in Darfur, Sudan, said using the help of a friend who was at the scene they started to pursue the stolen car.

“My friend had seen the car speeding off and we started following chasing it in the direction that it has gone,” Capt Dallu said.

As they were chasing the stolen car he informed his young brother Juma Dallu who posted the information in some WhatsApp groups in order to solicit help from people, especially out of concern from the little girl.

The chase was futile as they were soon lost by the car thieves but followed was a flurry of calls to Capt Dallu from both inside and outside the country as a result of the WhatsApp post.

“A few minutes after Juma had used his phone to post the message in WhatsApp I started receiving calls from as far away as the US, Italy and the UK asking me whether the message trending in WhatsApp groups was really true,” he noted.

About nine hours, around 21 hours after the incident Capt Dallu received a call from the Police informing him that his daughter had been found at a bar called Golden Bridge in the Kawe area, some three kilometres to the south east of Mbezi Juu. The car thieves had abandoned her at the bar and sped off. And at about midnight Capt Dallu received a call informing him that the Police had impounded the car at Kiwangwa Village, Bagamoyo District in the Coast Region.

Commander Mushongi said one suspect was arrested as two others escaped after one of them had handled his driving license.

Family members and friends became really concerned but this helped, he added. A relative who is a police officer quickly posted the message in WhatsApp groups of police officers and Capt Dallu started receiving calls from the police.

“Regional Police commanders from Dar es Salaam and the Coast Region started calling me to get more details of the incident and they quickly sprang into action to help recover my baby girl and the car,” Capt Dallu noted.

Coastal Regional Police Commander, Bonaventure Mushongi acknowledged to have learnt the issue from WhatsApp.

“Social media is a veritable social networking tool that is of paramount importance to the Police. The challenge remains the reliability of the information circulating because criminals can also use the platforms to misinform and mislead the public and the Police,” Commander Mushongi said, adding that the Police routinely monitor the social media to get information of what was going on.

In fact by late hours of Sunday the incident became the most trending in the major social media sites of WhatsApp, Facebook and Twitter.

Later in Sunday evening, however, some unknown people started circulating wrong information using eh same social media sites alleging that the little girl and the car have been found. This again prompted a flurry of calls from the Police and other people wanting to know whether the information was true. Fresh posts started circulating recanting the wrong information and the Police’s pursuit of the car thieves continued.

About nine hours, around 21 hours after the incident Capt Dallu received a call from the Police informing him that his daughter had been found at a bar called Golden Bridge in the Kawe area, some three kilometres to the south east of Mbezi Juu. The car thieves had abandoned her at the bar and sped off.

And at about midnight Capt Dallu received a call informing him that the Police had impounded the car at Kiwangwa Village, Bagamoyo District in the Coast Region.

via thecitizen.co.tz

Is Zuckerberg onto something? Why you should tape your webcam

mark-zuckerberg-tape-635x318

William Watterson via @thenextweb

In the past I’ve tried to emulate Mark Zuckerberg. Become a billionaire, celebrity, philanthropist, wear a sweatshirt or t-shirt everyday, drop out of college and don’t have to go to class anymore, what’s not to like? Sadly, for the most part, it hasn’t worked out so well for me.

For example, after seeing The Social Network I got exceptionally drunk and tried to write a college midterm paper – a la Zuck’s coding of the predecessor to Facebook while toasted. I read my essay the next morning and was genuinely amazed by how few actual words I had used in the six-page paper that I had written. While I was excited that I had created some kind of new language, I also realized that at best I was a J.R.R. Tolkien imitator and, sadly, not a budding Facebook billionaire.

As a result, I realized that maybe emulating Zuck wouldn’t work for me – I decided I probably shouldn’t drop out of college or wear sweats to my next job interview. Luckily there is more than one way to skin a cat. Today we can all be like Mark Zuckerberg and at the same time protect our privacy.

Earlier this year Instagram hit 500 million active users and in commemoration Zuck posted the above photo to his Facebook page. It’s a nice photo and if that was all it was I guess I could write a story about Mark Zuckerberg’s beautiful smile.

Instead, one sharp twitter user – @topherolson – noted that Mark had inadvertently revealed three things:

  1. That his Mac camera is covered with tape.
  2. That his Mac microphone is covered with tape.
  3. That his email client is Thunderbird.

Mark Zuckerburg is clearly worried about his cyber security – he is a high value target who has been hacked before – so instead I’m writing an article about the steps that Mark Zuckerberg takes to protect his privacy and why security experts think we muggles should all do the same.

Why you’re at risk

We live in an age of ever increasing connectivity and reliance on technology. At the same time, and as a direct result, we also live in an age where the NSA has the power to monitor emails and text messages sent by the American people. Not to mention the ability to secretly tap into hundreds of millions of Google and Yahoo accounts worldwide, where nearly one million new malware threats are released every day and where hacking costs the global economy an estimated $575 billion on an annual basis.

So yes, if you have a computer, if you use a phone, if you use email, you are at risk of being hacked.

While it might be easy to conclude that Mark Zuckerberg is your garden variety paranoid, eccentric, billionaire when he tapes over his laptop’s microphone and camera, in reality he is protecting himself against a risk that we all face.

Zuckerberg is protecting against “ratting.” While this might sound like some form of particularly painful medieval torture technique, it is actually slang for a Remote Access Trojan cyberattack (a uniquely modern torture technique). A RAT is a form of malware which, if successful, can give a hacker remote control of your computer – including your webcam and microphone.

Today the risk of this kind of attack is high –

70 percent of malware consists of Trojans and the most easily deployable of these is the RAT whose source code often only costs $10 to $50. Hackers can use this control to do a wide range of bad things to you:

  • Hijacking control of personal computers.
  • Watching and logging your keystrokes
  • Downloading, uploading, or deleting files
  • Destroying your CPU through overclocking
  • Installing additional viruses and worms
  • Editing your Windows registry
  • Using your computer for a denial of service attack and to otherwise infect friends and family
  • Stealing passwords, personal identification information, and credit card numbers
  • Wiping your hard drive
  • Installing hard to remove boot-sector viruses

And even to spy on victims through remote control of webcams and microphones.

For Zuckerberg this could mean the theft of sensitive Facebook business and personal data which could cause harm to Zuck personally, to employees, to his business, and to customers. However, by taping over his webcam and microphone Zuck has protected himself (and us all) against the worst of cybercrimes – the release of the first Mark Zuckerberg sextape – a true crime against humanity.

Billionaires aren’t the only ones in jeopardy

RAT attacks don’t just happen to those with billions at stake.

Amy Wright, was a 20-year old student at the University of California at Irvine – a far cry from a billionaire executive like Zuckerberg – when she was hit with a RAT attack.

GQ reported that Wright received an IM from mistahxxrightme, asking her for webcam sex. Amy said no. Mistah X IMed her again and said that he knew all about her. He described the color of her dorm room walls, her sheets, the pictures on her wall, her “pink vibrator”, and then finally sent her an image file. It was a picture of her in her room naked and having webcam sex with her boyfriend, James Kelly.

The “sextortion,” as it has been called, didn’t stop there.

Next Mistah X sent an IM to James Kelly’s ex-girlfriend, Carla Gagnon, asking her for webcam sex before sending her a video of her in the nude. Then he contacted Kelly and told him he had control of his computer. Mistah X taunted Kelly.

James tried to talk to Amy, but as soon as he did Mistah X sent him a message – “I know you’re talking to each other right now!” When Amy called the police, and the hacker messaged her, “I know you just called the police.”

It took the involvement of the FBI Cyberdivision to finally catch Mistah X – a 32-year old undocumented immigrant confined to a wheelchair and obsessed with Professor X from The X Men.

In total, he’d sextorted 230 victims and captured 15,000 webcam-videos, 900 audio recordings, and 13,000 screen captures. He was not part of any cybergang, but instead he was just one frustrated and depressed individual with access to a laptop.

Imagine the harm that an organized group of cybercriminals could do –  in 2014, a website opened that played live video from thousands of webcams in over 250 countries.

These attacks aren’t going away any time soon

The problem is that RATs are cheap, require relatively little technical skill, and as Scott Aken, a former FBI cyberagent explains, there are too many RATs in existence for law enforcement to bring them all down.

It’s also relatively easy to infect computers with RATs.

The threat is growing – malware is becoming more difficult to detect by integrating evasion techniques into code and is being built by more advanced groups, which since 2015 have created stronger and virtually unbeatable malware. These attacks are becoming so prolific that SnoopWall LLC labeled 2015 the year of the RAT.

Cyberextortionist gang the Cryptolocker managed to gross over $30 million in 2015 alone. Cybercriminals can see the ROI of these kinds of attacks and so they will only increase in number, both on high value targets and on individual consumers – particularly young women.

The Mark Zuckerbergs of the world and mere mortals alike need to protect themselves from these attacks. It is important to take steps to beef up the security of your devices by:

  • Ensuring your antivirus software is installed and always on.
  • Regularly changing secure passwords (and especially changing from the factory password)
  • Always keeping your firewall on.
  • Not clicking on suspicious links.

But in the end security experts – along with Mark Zuckerberg – think that, however secure your device is, it won’t be enough to stop a determined cybercriminal.

Last year NTT tested the top antivirus products and concluded that 50 to 70 percent of malware made it past their virus scanners – new types of malware are being created faster than security companies can detect or protect against them. And when you might be up against the NSA – whose GCHQ program selected random Yahoo webchat users to surveil, the FBI, and increasingly organized (and often state-sponsored) cybercriminal gangs, it’s safe to assume that their attacks could be more powerful than your defense.

As a result, experts think that we should all steal a page from the paranoid billionaire playbook and take the basic security measure of covering our webcam and microphone when they are not in use. Lysa Myers, a security researcher at the Data Security firm ESET said in an email to the NYTimes:

Covering the camera is a very common-sense security measure. If you were to walk around a security conference, you would have an easier time counting devices that don’t have something over the camera.

So let’s all do the smart thing and copy the security experts and the boy genius – FBI director James Comey is doing the same. Comey told NPR that he covers his laptop camera and microphone, “because I saw somebody smarter than I am had a piece of tape over their camera.”

And it’s easy to do. You can cover your camera and microphone with a post-it note, duct tape, painters tape, cute cat stickers, invisible tape, washi tape, or even spring for a sticker expressly designed for laptop camera and microphone security (to the tune of only $10).

While this might make you look paranoid, it’s an easy step to protect your privacy from the growing threat of cyberintrusion.

On the other hand, for those of you who think that you have nothing to hide, you can always follow the example of Matthew Green: “Because I’m an idiot,” replied Matthew Green, an encryption expert at Johns Hopkins University when asked why he doesn’t cover his cameras.

I have no excuse for not taking this seriously… but at the end of the day, I figure that seeing me naked would be punishment enough.

Black Mirror on Netflix – an anthology series that tackles our relationships with technology and how each bright moment today could potentially go awry tomorrow. With them, we’re exploring current and future tech trends; including the possible ramifications on personal relationships. This is the “bright side” of technology.

Hackers used internet of things connected devices, to attack popular websites on Friday

internet-of-things

Hackers used internet-connected home devices, such as CCTV cameras and printers, to attack popular websites on Friday, security analysts say.

Twitter, Spotify, and Reddit were among the sites taken offline on Friday.

Each uses a company called Dyn, which was the target of the attack, to direct users to its website.

Security analysts now believe the attack used the “internet of things” – web-connected home devices – to launch the assault.

Dyn is a DNS service – an internet “phone book” which directs users to the internet address where the website is stored. Such services are a crucial part of web infrastructure.

On Friday, it came under attack – a distributed denial of service (DDoS) – which relies on thousands of machines sending co-ordinated messages to overwhelm the service.

The “global event” involved “tens of millions” of internet addresses.

Security firm Flashpoint said it had confirmed that the attack used “botnets” infected with the “Mirai” malware.

Many of the devices involved come from Chinese manufacturers, with easy-to-guess usernames and passwords that cannot be changed by the user – a vulnerability which the malware exploits.

“Mirai scours the Web for IoT (Internet of Things) devices protected by little more than factory-default usernames and passwords,” explained cybersecurity expert Brian Krebs, “and then enlists the devices in attacks that hurl junk traffic at an online target until it can no longer accommodate legitimate visitors or users.”

The owner of the device would generally have no way of knowing that it had been compromised to use in an attack, he wrote.

Mr Krebs is intimately familiar with this type of incident, after his website was targeted by a similar assault in September, in one of the biggest web attacks ever seen.


It has emerged that the BBC’s website was also briefly caught up in Friday’s attack. The BBC is not a customer of Dyn itself, but it does use third-party services that rely on the domain name system hosting facilities provided by Dyn.

I understand that these include Amazon Web Services – the retail giant’s cloud computing division – and Fastly – a San Francisco-based firm that helps optimise page download times.

Both companies have acknowledged being disrupted by the DDoS assault. Only some BBC users, in certain locations, would have experienced problems and they did not last long.

But there are reports that other leading media providers also experienced similar disruption.

It serves as a reminder that despite the internet being a hugely robust communications system, there are still some pinch points that mean a targeted attack can cause widespread damage.


The incidents mark a change in tactics for online attackers.

DDoS attacks are typically aimed at a single website. Friday’s attack on Dyn, which acts as a directory service for huge numbers of firms, affected several of the world’s most popular websites at once.

The use of internet-connected home devices to send the attacking messages is also a relatively new phenomenon, but may become more common.

The Mirai software used in these attacks was released publicly in September – which means anyone with the skill could build their own attacking botnet.

On social media, many researchers and analysts expressed frustration with the security gap being exploited by attackers.

“Today we answered the question ‘what would happen if we connected a vast number of cheap, crummy embedded devices to broadband networks?’” wrote Matthew Green, an assistant professor at the Johns Hopkins Information Security Institute.

Jeff Jarmoc, head of security for global business service Salesforce, pointed out that internet infrastructure is supposed to be more robust.

“In a relatively short time we’ve taken a system built to resist destruction by nuclear weapons and made it vulnerable to toasters,” he tweeted.

What Is DNS and Why Does It Make the Internet Break?

Today, half of America’s internet shut down when hackers unleashed a large distributed denial of service (DDoS) attack on the servers of Dyn, a major DNS host. It’s still unclear exactly who carried out the attack and why, but regardless, the event served as a demonstration of how easily large swaths of the web can be wiped out if attacked by determined hackers.

Dyn released this statement following the outage:

Starting at 11:10 UTC on October 21th-Friday 2016 we began monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Some customers may experience increased DNS query latency and delayed zone propagation during this time. Updates will be posted as information becomes available.

It’s horrific to know that major websites like Twitter, Spotify, Reddit, Etsy, Wired, and PayPal can all be taken offline in an instant. The exact process hackers used is so far unknown—aside from the DDoS detail—but it’s important for every internet user to understand because it has to do with how exactly the internet works. With that in mind, here is how some of the most popular websites in the world can be taken offline in a flash.


What is the technology?

Domain Name Servers (DNS) act as the internet’s phone book and facilitate requests to specific webpages. They make sure you end up in the right place every time you type a website into your browser. Hackers will occasionally attack DNS providers in order to bring down the sites they are serving. Today, that happened to be Twitter, Reddit, PayPal and more.

That’s a really basic overview. But if you really want to understand how DNS works at a deeper level, you have to follow the complete order of operations. A typical internet user starts at one of many computers in a large network connected through underground cables (such as your laptop). The individual nodes on these networks communicate by referring to each other with numbers known as IP addresses. DNS is used to translate a request like a URL into an IP address.

When you enter a URL—such as www.Gizmodo.com—your browser starts trying to figure out where that website is by pinging a series of servers. It’s very detailed, and we won’t bore you with the complete chain of events. There are resolving name servers, authoritative name servers, domain registrars, and so on. The system is precisely configured to get you from browser bar to website seamlessly. The process is a little crazy, but perhaps the most insane part is that it all happens almost instantly. Anytime you’re browsing the web, opening dozens of tabs, requesting a bunch of different websites, your computer is pinging servers around the world to get you the right info. And it just works—until it doesn’t.


How does it break?

A DDoS attack is a common hack in which multiple compromised computers are used to attack a single system by overloading it with server requests. In a DDoS attack, hackers will use often use infected computers to create a flood of traffic originating from many different sources, potentially thousands or even hundreds of thousands. By using all of the infected computers, a hacker can effectively circumvent any blocks that might be put on a single IP address. It also makes it harder to identify a legitimate request compared to one coming from an attacker.

In the case of this morning’s attack, hackers brought down the servers of Dyn, a hugely popular DNS host that manages sites like Basecamp, CNN, Etsy, Github, Grubhub, HBO Now, Imgur, Paypal, Playstation Network, Reddit, Squarespace, and Twitter.

When the servers of Dyn were taken down, browsers essentially couldn’t figure out where to go to find the information to load on the screen. This type of attack happens every so often when hackers create a little army of private computers infected with malicious software known as a Botnet. The people that are often participating in the attack don’t realize their computer has been compromised and is part of a zombie army of attackers. In 2014, a hacker group called Lizard Squad shut down the Playstation Network and Xbox Live using this method. In 2015, a trojan virus called XOR DDoS helped hackers create a powerful botnet capable of taking down almost any server or website.

Defending servers against DDoS attacks can be difficult, but there are ways to prevent outages. According to Network World, one of the most common methods used is flow sampling, in which the system samples packets and identifies trends in network traffic. A flow analytics device evaluates traffic streams and identifies potentially bad traffic.


How do we protect ourselves?

Looking ahead, one big question stands out. How can we avoid attacks like this stealing internet access away from millions of Americans and losing companies millions of dollars in revenue?

The answer is complicated. As soon as security companies come up with new ways to protect companies like Dyn, hackers come up with new ways to attack them. In the case of DNS infrastructure, however, many point out that the best way for a website to avoid getting brought down by an attack on one host is simply to subscribe to multiple hosts. This is called DNS redundancy, and it’s probably the reason that some sites (like Pornhub) survived the attack unscathed.

In the case of the Dyn servers, it’s unclear exactly how they solved the problem, but the company is now reporting the issue resolved—about one hour after the problem started.

Via @Gizmodo