Dyn DNS Mirai DDoS attack

On 21 October 2016, three waves of distributed denial-of-service traffic struck Dyn, a managed DNS provider whose servers translated domain names for some of the internet's busiest sites. The attack — powered by the Mirai botnet of hijacked IoT devices — took Twitter, Netflix, Spotify, GitHub, Reddit, Airbnb, PayPal, and dozens more offline for users across the United States and Europe, and made "insecure smart devices" a mainstream security concern overnight.

What happened

Dyn operated authoritative DNS — the infrastructure that resolves human-readable domain names into IP addresses. When Dyn's servers became unreachable, browsers could not look up the addresses of any site that relied on Dyn, even though those sites' own servers were perfectly healthy. The result was a cascade of apparent outages across the web.

The traffic came from the Mirai botnet, a network of hundreds of thousands of compromised Internet of Things devices — IP cameras, DVRs, and home routers that shipped with default or hard-coded passwords. Mirai scanned the internet for such devices, logged in with a built-in list of common credentials, and enlisted them to flood targets on command. At its peak the Dyn attack drew on tens of millions of IP addresses, with widely reported volumes in the range of 1.2 Tbps.

The attack waves

The assault came in three distinct waves on 21 October:

1. ~11:10 UTC — the first wave struck Dyn's East Coast infrastructure, breaking name resolution for a long list of major customers.
2. ~15:50 UTC — a second, larger wave widened the outage across the U.S. and into Europe. At its height, roughly 75% of monitored global vantage points received no answer to Dyn queries.
3. ~20:00 UTC — a third wave was largely absorbed as Dyn filtered malicious traffic and rerouted.

By 22:10 UTC, after about 11 hours of intermittent disruption, Dyn declared the incident resolved.

Attribution

The Mirai botnet was the creation of Paras Jha, Josiah White, and Dalton Norman, three young men who had built it initially to attack Minecraft servers and rival DDoS-for-hire operations. After Mirai's source code was published online in September 2016 (following a record attack on journalist Brian Krebs), copycat botnets proliferated — and it remains unsettled whether the Dyn attack was launched by the original authors or by one of the many derivative botnets. The three creators pleaded guilty to federal charges in December 2017.

Why it matters

The Dyn attack was a watershed for two reasons. First, it showed that DNS is a single point of failure for much of the web: knocking out one managed DNS provider can darken hundreds of unrelated services at once, prompting many large sites to adopt redundant, multi-provider DNS. Second, it made the insecurity of consumer IoT devices undeniable, accelerating regulation such as California's IoT security law (SB-327) and the UK's PSTI Act, which banned default passwords on connected devices. Mirai's template — scan, brute-force default credentials, conscript, flood — became the blueprint for a generation of IoT botnets that followed.