Bugtraq mailing list archives
Re: recursive DNS servers DDoS as a growing DDoS problem
From: Gadi Evron <ge () linuxbox org>
Date: Thu, 30 Mar 2006 22:23:58 +0200
Geo. wrote:
The flood is a flood of answers not queries, you spoof the source address of a query with the address of your target, the target gets the response from the dns server. A cache on the dns server just makes it a more efficient response.
Queries are bad enough. This can be played with from any point in the chain. I.e. from the amount of querying clients, the number of so-called "relaying servers", possible /effective/ amplification and the size of the TXT SOA record.
Increase any of these and you somewhat increase the attack if one of the others is controlled. So treating just one is not really a solution.
We provided with an equation of sort to this effect in the paper we pre-released for the community when the FUD started (was supposed to eventually be an academic paper):
http://www.isotf.org/news/DNS-Amplification-Attacks.pdfYes, in my opinion recursion should be put under better control, but it's what-a-mole all over again if we do it by running after servers. The problem here (if we are to ignore just for a moment other UDP/DNS attacks) is with the attack vector - spoofing.
Many networks today allow spoofing.Should recursion by default be disabled? Yes. Is it a problem when done insecurely? Yes. Is it what we should run after on the "client-side" servers? No, or maybe not Yes but not Only.
I have not seen a perfect solution yet, at best the solutions I've seen mentioned eliminate this one flood vector. I would suggest that when considering which one to choose we look at what we lose with each choice. Eliminate spoofing and you lose virtually nothing, eliminate open recursive
I am with you so far. Spoofing is not the only problem of the Internet by far, but is is a problem mostly ignored thus far as it was not actively exploited *sniff*
servers and you have just created a really powerful control mechanism for entities to control large sections of the internet since folks from those sections won't be able to use anyone else's DNS servers or even run their own (much like port 25 blocking limits who can run a mail server today). He who controls dns controls the network.
Is this like when you brought up Government conspiracies in this regard on another list?
I can understand discussion going on with different lists, I sin with that myself recently. There were no direct lists to handle DNS or botnets issues until not long ago, still - should we just skip a list whenever you are disagreed with?
Gadi.
Current thread:
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Apr 01)
- <Possible follow-ups>
- RE: recursive DNS servers DDoS as a growing DDoS problem gboyce (Apr 01)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Jim Pingle (Apr 04)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Jim Pingle (Apr 09)
- Re: recursive DNS servers DDoS as a growing DDoS problem Erwan David (Apr 09)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Tim (Apr 04)