Many people had a tough time using certain web sites this morning. Twitter, Spotify, Airbnb, and PayPal were among many sites that experienced performance issues for short periods today.
It was caused by a distributed denial of service attack on a company called Dyn, Inc. A DDoS attack basically floods a site with traffic and overwhelms its servers. But why did the attack on Dyn impact so many other companies? It’s because of something called DNS, domain name servers.
That’s the service that translates the words we type in for websites, like “marketplace.org,” into the IP address that actually directs you to the site.
“Unfortunately a lot of the services we create today sort of assume the DNS is not going to be a problem,” said Joseph Lorenzo Hall of the Center for Democracy and Technology. “[We think] It will be quick and work, and I think we need to rethink that.”
Dyn handles DNS for many other companies, which is why an attack on its servers spread so widely.
“So what [the hackers have] done is they’ve jammed up all the traffic from that one company so it’s like when you went to look for something, you basically got the internet version of a busy dial tone,” said Shane Tews is a cybersecurity expert and visiting fellow at the American Enterprise Institute. And basically thousands — if not millions — of previously compromised connected devices were all calling at once.
But why did the attack primarily affect the east coast? Ann Barron-DiCamillo, chief technology officer at Strategic Cyber Ventures, said much of America’s internet infrastructure still relies on old-fashioned wires to get data from place to place. And Dyn’s case, those wires all led to one key point in New Hampshire.
“The data center that houses their DNS servers are located geographically in this area,” she said. “And because of how DNS traffic is routed, the primary region of impact was the east coast region.”
Dyn says its engineers are investigating the attack, as is the U.S. Department of Homeland Security.
Correction (Oct. 21, 2016): A previous version of this story misspelled Dyn’s name.