10 ms·
Attack on DNS root servers
- ck2 11y agoChina testing something new? Or maybe some scriptkiddie testing their new botnet?
- KG8 11y agoWhy China of all of the 193 countries? What about Russia? US? Brazil? England?
- bluedino 11y agoSo what were the domain names queried?
- deleted 11y ago[deleted]
- ajhurliman 11y agoRooftops?
- 882542F3884314B 11y agoRoot Server Operators = rootops
- ajhurliman 11y agoAh, I see. Thanks :)
- cft 11y ago"Source Address Validation and BCP-38." ISPs should validate the source address of UDP traffic from their end customers. This would end most UDP based volumetric DDoS attacks.
- sp332 11y agoIt would help reflection attacks that direct e.g. DNS responses to the target. It wouldn't help when the DNS servers themselves are the target.
- cft 11y agoThe OP says that IP addresses were "randomly distributed" over IPv4 space. That's very unlikely for non-spoofed botnet addresses.
- sp332 11y agoYes, but for a volumetric attack, it doesn't matter if you know the source IPs. It just fills your pipes until legitimate traffic can't get through. (This wasn't a volumetric attack though, which is why it would have helped.)
- cft 11y agoBut most volumetric attacks are reflection attacks, which would be impossible if BCP-38 were implemented everywhere. Direct non-reflection volumetric attacks of significant magnitude (say above 40Gbps) are almost non-existent.
- Dylan16807 11y agoThe botnet would still be able to perform an attack of the same size. And with many validation schemes it would still be able to randomize the last octet or two, avoiding direct identification of compromised computers.
- deleted 11y ago[deleted]
- lucb1e 11y agoWhat made this unique now? Was it simply a high load?
- deleted 11y ago[deleted]
- finnn 11y agoTowards the bottom of the extremely short article/message: 3. Analysis This event was notable for the fact that source addresses were widely and evenly distributed, while the query name was not. This incident, therefore, is different from typical DNS amplification attacks whereby DNS name servers (including the DNS root name servers) have been used as reflection points to overwhelm some third party. The DNS root name server system functioned as designed, demonstrating overall robustness in the face of large-scale traffic floods observed at numerous DNS root name servers. Due to the fact that IP source addresses can be easily spoofed, and because event traffic landed at large numbers of anycast sites, it is unrealistic to trace the incident traffic back to its source. Source Address Validation and BCP-38 should be used wherever possible to reduce the ability to abuse networks to transmit spoofed source packets.
- lucb1e 11y ago> was notable for [random source addresses] I thought that was a common thing to do if it's not reflected. Flooding the pipe is older rather than newer. Thanks for clarifying though!
- paulmd 11y agoMost, but not all, DNS root name server letters received this query load. Why would you want to take down every DNS server though? That's not a very effective tactic due to caching, and what's the motive?
- profmonocle 11y agoPossibly testing or demonstrating a botnet. I doubt the goal was to actually bring down the DNS root servers. That's been tried before and it's never even made a blip - the system is massively over-provisioned, for good reason.
- robryk 11y agoI suspect that this might have been a botnet showing off to its potential clients. This may explain withholding of the domain names queried (not to give advertising to the botnet).
- comboy 11y agoWell I'm pretty impressed. observed traffic volume due to this event was up to approximately 5 million queries per second, per DNS root name server letter receiving the traffic. i.e. over 50 million queries per second distributed evenly across IPv4
- deleted 11y ago[deleted]
- johansch 11y agoIt was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s. Is that really so impressive these days?
- comboy 11y agoIs it really that trivial to fake source IP? I think pretty much any ISP wouldn't let such packets through (or am I missing something?), and you are also easier to find then (well, if you are not careful that is).
- __jal 11y agoIf this was a botnot, any one ISP is only seeing a tiny fraction of the load. Even if it were from a single source, it also isn't that hard to find an ISP that doesn't care. (They cost slightly more, but if you're a bad actor, presumably it is worth it.) Edit: "I think pretty much any ISP wouldn't let such packets through" If you google "BCP38", you will find well over a decade of network operators discussing specifically this topic and the reasons why ISPs (and other networks) don't, not to mention all the fun the kvetching and meta-kvetching that accompanies any technical discussion that's lasted so long.
- Goopplesoft 11y agoWhy is root-servers.org not https?
- peterwwillis 11y ago.....Why would it be?
- macns 11y agoto protect a visitor's privacy
- medecau 11y agoOr to ensure that the content is not tampered.
- peterwwillis 11y agoNobody would tamper with this content.
- Buge 11y agoChina injected javascript malware into non-https traffic that joined the users into a botnet that launched a DDOS attack on Github. The "Great Cannon".
- peterwwillis 11y agoThe "Great Cannon" only targeted foreign traffic destined for Chinese websites. This one is not.
- Buge 11y agoYes but they just as easily could have targeted traffic to this site as well. Also a number of ISPs and wifi hotspots inject ads, and I know Verizon injected a tracking header based on your mobile plan.
- navadavuluri 11y agoIs there significance to NTP requests in relationship to DDOS?
- tptacek 11y agoYes; NTP is an amplification vector, which means you can spoof a small NTP request and generate a large NTP response aimed at your target.
- mb0 11y agoYes. Both NTP and DNS operate over UDP. UDP is a connectionless protocol, which means no connection handshake needs to be made in order for a data to be delivered to a target IP address. What generally happens is, one attacker will send many requests to a many DNS and or NTP servers whilst spoofing their IP address to make it appear as if their victim is sending all of these requests. No connection handshake happens to verify that the victim is actually making these requests. So, every server that the attacker sent this request to will send the much-larger answer back to the victim. If DNS were to only operate over TCP (which uses a connection handshake), the internet would be much slower, because connection handshakes can take a while. However, this isn't what happened on Monday. It seems like one attacker with a lot of systems used those systems to query someone's domain name whilst spoofing many IP addresses at once. This in turn overwhelmed many of the root servers, and possibly several authoritive DNS servers in the process. Sounds like a botnet owner was showing off how much power they have.
- llasram 11y agoI bet the observed "random" source addresses are open recursive DNS servers. For this kind of attack they provide essentially free traffic-washing for whatever actual traffic-generation mechanism the attackers have.
- majke 11y agoNope. The open recursive DNS servers, are real DNS servers, with caching and backoff logic. If, say, there are 94k [1] open DNS resolvers in the wild, each will ask you one DNS question for example.com, cache the answer and that's it. The big volume for the "fixed domain" queries indicates proper BCP-38 spoofing. [1] http://public-dns.tk/ http://public-dns.tk/
- llasram 11y agoUnless the attacker controlled the domain TTL, maybe? But good point -- I was thinking of a similar attack using random domains.
- majke 11y agoOpen recursors asking for random subdomains can generate bigger volume of attack, but still, they are smart and will fall back if the server is overwhelmed. Even if you're assuming 100 qps from each of the 94k recursors, that's only 9.4M qps. And most of the recursors will notice lack of answer and will slow down / stop the queries. In practice random subdomain attacks rarely generate more than a million qps (YMMV, there are exceptions, technical nitpics, etc).
- theanomaly 11y agoThe trick is to request random top-level domains, where each request will necessarily trigger a lookup to the root. Further, recent research has shown the number of open DNS resolvers to be in the range of 15-30 million[1]. Since the article describes a single domain name was used in the attack however, that's not what happened here. [1] http://icir.net/mallman/papers/dns-probe-meth-imc13.pdf http://icir.net/mallman/papers/dns-probe-meth-imc13.pdf
- SixSigma 11y agorelated ? Day 2: UK research network Janet still being slapped by DDoS attack DNS services appear to be targeted, switching may work http://www.theregister.co.uk/2015/12/08/uk_research_network_janet_ddos/ http://www.theregister.co.uk/2015/12/08/uk_research_network_...
- chei0aiV 11y agowhat was the query string?
- rmdoss 11y agoThe beauty of DNS: No one was affected or noticed the problem. Resolvers just tried another one if they didnt get a response from one of the root servers.
- paulddraper 11y agoDNS would be a disaster if taken down. It's also impossible.
- gawi 11y agoDonald Trump's failed attempt to shut down the Internet.
- Ayaz 11y agoThey don't mention otherwise but do we know if the attack has happened again since 1 December?