3 ms·
I wonder if this can be used to automatically shut down the DNS servers participating in a reflected DDoS recursion attack: those are unpatched.
by cft 11y ago
I wonder if this can be used to automatically shut down the DNS servers participating in a reflected DDoS recursion attack: those are unpatched.
- seiji 11y agoWith an attack like that, you know the inbound IPs targeting you are already vulnerable, so know what you can do? You can turn them back on themselves to attack the attack. This approach is not recommended by legal professionals.
- cft 11y agoAttacking them back involves DDoS, I.e. time, infrastructure and legality issues. This stops an attack instantly.
- seiji 11y agoWell, you can reflect their bad DNS back at them using their own methods. You can write less than 200 lines of code to destroy your attackers. Morally right in an if-someone-tires-to-kill-you-kill-them-right-back way? Certainly legally wrong since most of the participants in these attacks are misconfigured "innocent" 3rd parties, not hostile entities themselves.
- valarauca1 11y agoAmusingly in their 2012 talk at Defcon CloudFlare talked about using Unpatched Open DNS Resolvers to basically reflect back against themselves until they all crashed as a way of mitigating a DDoS. The problem is the internet can't handle that much bandwidth at once. While every Open DNS Resolver would crash, so would the whole internet :P