What Happened to Facebook, Instagram, and WhatsApp?

Re:What Happened to Facebook, Instagram, and WhatsApp? by thepasswordis on Monday October 04, 2021 @04:39PM (#28751786)

Yes. It's basically turned every device, especially mobile devices with the app running in the background, into botnet clients which are continually hitting their DNS servers.

I don't know what facebook's DNS cache expiration interval was, but assume it's 1 day. Now multiply the load on the DNS that those facebook users put by whatever polling interval the apps use.

And then remember what percentage of internet traffic (requests, not bandwidth) facebook, whatsapp, and instagram make up.

It's kindof beautiful.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by reaperducer on Monday October 04, 2021 @04:51PM (#28751927)

It's basically turned every device, especially mobile devices with the app running in the background, into botnet clients which are continually hitting their DNS servers

Anecdotally, it also seems to be draining the batteries of those devices with all of those extra queries. At least that seems to be what's happening on my wife's phone.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by wozer on Monday October 04, 2021 @05:03PM (#28752052)

Now I'm a bit worried.

Could this bring down the whole internet for a while?

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by mattowen_uk on Monday October 04, 2021 @05:23PM (#28752245)

Well, everything is bit slow for me. I'm in the UK on Virgin Media, using either Google DNS or the VM ones (I'm not sure and can't be bothered to look).

What has just happened, and it can't be coincidence, is that I lost internet connectivity about 1 hour ago, and had to reboot my Cable Modem to get it back.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by _jstreet on Monday October 04, 2021 @05:18PM (#28752197)

I'm fairly certain that my ISP was affected by this causing an outage of all internet traffic for my network. So it seems possible, although I imagine using an alternate DNS provider should work ok (if they're not overrun by extra traffic)?

Unfortunately I'm not sure what the default DNS on the modem points to..

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by r721 on Monday October 04, 2021 @05:27PM (#28752283)

You can try https://dnsleaktest.com/ which shows which DNS server is actually used.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by gpvos on Monday October 04, 2021 @05:44PM (#28752456)

I read it brought down the Vodafone network in Czechia, one of the major providers there.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by notyourday on Monday October 04, 2021 @04:51PM (#28751930)

... and the facebook SDK. Every single app that has facebook SDK is blowing up now.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by universenz on Monday October 04, 2021 @04:21PM (#28751571)

Further to this, doesn't Chrome and Safari quietly auto-ping/reload pages that "fail to connect" if they're left open in a tab or browser?

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by yawaworht1978 on Monday October 04, 2021 @04:35PM (#28751740)

How often do the apps try to reconnect? Does anyone know?

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by vakabus on Monday October 04, 2021 @05:32PM (#28752335)

I've launched Wireshark monitoring DNS traffic of roughly 5 phones. I've collected 19.8k DNS packets so far. Out of that, 5.1k packets are flagged with REFUSED or SERVFAIL. If I am not mistaken, it means that 51% of DNS requests fail.

Looking at queries for graph.instagram.com, it looks like there are roughly 20 attempts in a sequence before it gives up.

All in all, this could probably explain doubling of the DNS traffic. But the sample is rather small, so take it with a grain of salt.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by dotancohen on Tuesday October 05, 2021 @03:50AM (#28756549)

5.1 / 19.8 is much closer to a quarter than to half. But your point is still just as poignant at ~25% as it is at 51%.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by profile53 on Tuesday October 05, 2021 @04:44AM (#28756842)

I think those are DNS round trips. So 1 packet to request and 1 to respond. E.g. 9.9k total requests of which 5.1k fail.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by colpabar on Monday October 04, 2021 @04:37PM (#28751764)

Sort of, yeah. Typically a DDoS attack is done on purpose, this is a side effect of so many clients utilizing retry strategies for failed requests. But in both cases, a lot of requests are being made, which is how a DDoS attack works.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by samhw on Monday October 04, 2021 @04:30PM (#28751694)

Equivalent how? In volume? In intention?

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by j-bos on Monday October 04, 2021 @05:25PM (#28752261)

In volume.

[ Parent | on HN ]

Re:What Happened to Facebook, Instagram, and WhatsApp? by samhw on Monday October 04, 2021 @06:12PM (#28752773)

Ah, I getchu. In that case you're probably not wrong. It must be an absolutely redoubtable volume of traffic.

[ Parent | on HN ]