Full Disclosure mailing list archives
Re: DNS bind attacks
From: "Roberto Navarro - TusProfesionales.es" <rnavarro () tusprofesionales es>
Date: Thu, 26 Jan 2012 20:15:36 +0100
There's a lot written about this particular on Dns-Operations, NANOG and other lists: http://mailman.nanog.org/pipermail/nanog/2011-December/042562.html https://lists.dns-oarc.net/pipermail/dns-operations/2011-December/007852.html Also, it was published by dyndns staff some time ago: http://dyn.com/active-incident-notification-recent-chinanetany-query-floods/ It's some kind of amplification attack, and you'll find a lot of information on the mail archives. ----- Original Message ----- From: Gage Bystrom To: J. von Balzac ; full-disclosure () lists grok org uk Sent: Thursday, January 26, 2012 1:40 PM Subject: Re: [Full-disclosure] DNS bind attacks Other than the fact they may somehow notice this and start trying to autoban sites you should be fine. Since he is spoofing it would be hard for him to tell without trying it out on a box he controls. If anything gets autobanned you really need then just whitelist it, if you can think of such places before hand then go ahead and whitelist them now. Just be aware in case its not a ddos but really part of some exploit of sorts, as owning a bind server is obviously very appealing. Now if any would be a good time to do a double check on your security measures but in all likelihood it seems like a fairly weak attack and your measures should be fine. That or we are both missing some glaring piece of information. On Jan 26, 2012 3:36 AM, "J. von Balzac" <jhm.balzac () gmail com> wrote: I'm seeing a lot of hosts in my named logs (I mean log files, it's not like I am naming my poop) ...ok... silly joke hehe So anyway, named bind is reporting a lot of denied queries of type 'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which is to immediately block the IPs for port 53 after as few as one denied query) - but I want to warn server admins who haven't spotted both these queries and other denied queries. Common sense suggests that these hosts are probably spoofed IPs. Looks like an effective way to ddos a host: request an arbitrary DNS record with a spoofed IP and let the server reply to the spoofed IP in whatever way. Do that with many hosts and there is your denial of service. A side effect is that when you block the IP, you're blocking something that isn't really doing anything wrong as it's a spoofed IP But ok, I'm not too sure of this so please shoot holes in my theory or suggest better fixes/workarounds/... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- DNS bind attacks J. von Balzac (Jan 26)
- Re: DNS bind attacks Gage Bystrom (Jan 26)
- Re: DNS bind attacks Roberto Navarro - TusProfesionales.es (Jan 26)
- Re: DNS bind attacks Jeffrey Walton (Jan 26)
- Re: DNS bind attacks Chris Granger (Jan 26)
- honeypots lallantada (Jan 30)
- Re: honeypots Vipul Agarwal (Jan 30)
- Re: DNS bind attacks Gage Bystrom (Jan 26)