【Lina Romay】

Source：Creation Information Network Editor：Tech Time：2025-06-26 05:51:27

While much of the internet was frantically trying to refresh their browsers on Lina RomayFriday, the folks at Dyn were facing a huge digital assault that appeared to be coming from just about everywhere.

Their servers were swamped and, because Dyn provides domain name services to many of the most popular sites on the internet, that's all the online community was talking about.

SEE ALSO: How an attack on a company you've never heard of crushed the internet

The attack -- known as a distributed denial of service (DDoS) -- was indeed bad. DDoS attacks are defined by a flood of "junk data" that clogs a specific site so legitimate users can't get through.

You May Also Like

Original image has been replaced. Credit: Mashable

Someone -- Dyn won't comment on who, but more on that later -- had hacked a significant number of video cameras and digital video recorders hooked up to the internet, and hurled that junk data at Dyn.

The domino effect left websites such as Twitter, Spotify and others sluggish or unreachable to the average user, so users naturally refreshed their pages again and again.

Mashable Trend Report Decode what’s viral, what’s next, and what it all means. Sign up for Mashable’s weekly Trend Report newsletter. By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use and Privacy Policy. Thanks for signing up!

That was all legitimate traffic, but according to a Wednesday post on Dyn's website, it was hard to distinguish legitimate from malicious traffic at the time. They thought they were defending themselves from something even greater, as many IP addresses generated 10 to 20 times their normal amount of traffic.

"When DNS traffic congestion occurs, legitimate retries can further contribute to traffic volume," Scott Hilton, the executive vice president of product at Dyn, wrote in Wednesday's post. "We saw both attack and legitimate traffic coming from millions of IPs across all geographies. It appears the malicious attacks were sourced from at least one botnet, with the retry storm providing a false indicator of a significantly larger set of endpoints than we now know it to be."

Original image has been replaced. Credit: Mashable

Dyn now estimates the attack came from around 100,000 "malicious endpoints," rather than millions as previously expected.

Though they're not saying who hacked the devices needed to mount the attack, Dyn and Flashpoint, a cybersecurity firm, have confirmed that the hackers used a malware known as Mirai to break into the cameras and DVRs.

Flashpoint hasn't confirmed a perpetrator either, but they have reason to believe the attack came from a hacker or group of hackers who just wanted to show off.

The cybersecurity firm found the attackers also hit a video game company while they were sending waves of junk data at Dyn, something that's not typical of a state actor or a group trying to steal money.

Instead, Flashpoint believes the hacker or the group is "likely connected to the English-language hacking forum community, specifically users and readers of the forum 'hackforums[.]net,'" a forum frequented by hackers who often launch similar types of attacks.

Previous：The Baffler’s May Day Round Up

Next：Watch how an old Venus spacecraft tumbled before crashing to Earth

【Lina Romay】

Related Articles

Related Recommendations

Categories

Latest Articles

Popular Articles

Hot Recommendations

Featured Column

Quick Links

Quick Links