by Bryon D Beilman
Earlier this week Godaddy had a major outage that affected thousands and some say millions of web sites or domains. I got an early glimpse of it while it was happening and was following the AnonymousOwn3r twitter feed because he was claiming responsibility for taking it down. Having been on other side of trying to keep sites up in the midst of a DDOS attack , I thought that it was entirely possible. The mitigation techniques of Godaddy reported by wired.com that GoDaddy moved their DNS servers to a competitor during the heat of the event, seemed to support this as Verisign perhaps had better DDOS protection. Godaddy says they had an internal failure, but a well designed DNS infrastructure is designed to have slaves, shadow masters, protection and distributed information, especially from a company that provides DNS services to millions. I would expect that they would have a very well designed infrastructure and I would be surprised if they had a failure of this type, or would I???
During the twitter feed the AnonymousOwn3r and others were tweeting their other feats of hacking, including taking down parts of Facebook and they were the one who hacked the FBI to get the Apple UDIDs. He said that he could take down Google as well. I admit, that I was breathing this all in, wide eyed and thinking about what we need to do for our customers to ensure that this type of thing does not happen to them. I was partially impressed with the number of bots/hacked servers that they perhaps had at their disposal to take someone like Godaddy down. But now that the smoke has cleared, the picture becomes a little more clear.
The CIO article on the FBI hack reports where the real source of the Apple UDIDs came from, which immediately discredits Anonymous Own3r and doesn't sound as impressive as the java hack on the FBI. As reported in the Daily Beast, whatever happened to Godaddy, Anonymous Own3r really hacked the media and those following that event. As people dig in to investigate the truth, Anonymous Own3r is still trying to prove that it was him, by posting DNS code he said belongs to Godaddy, but even that is now shown to be from a Google Code project which he was trying to pass off as the Godaddy code. Perhaps we will never know what happened, but it is becoming clear what didn't happen.