5 ms·

It is kind of epic how DJB predicted this. "Domains with DNSSEC, because of the size of some responses, are usually ripe for this type of abuse, and many DNS p

It is kind of epic how DJB predicted this. "Domains with DNSSEC, because of the size of some responses, are usually ripe for this type of abuse, and many DNS providers struggle to combat DNSSEC-based DDoS attacks. Just last month, Akamai published a report on attacks using DNS lookups against their DNSSEC-signed .gov domains to DDoS other domains. They say they have seen 400 of these attacks since November." https://cr.yp.to/djbdns/forgery.html https://cr.yp.to/djbdns/forgery.html

xorcist 11y ago
That link is about source port randomization in DNS, which Bernstein was a proponent of and most software implement today. DDoS by DNS is something else entirely. The cookies that Bernstein advocate does not help here. Only ingress filtering helps, but it has to be implemented world wide before it useful, and not many bother unless forced to. That much was well known at the time, and not something Bernstein predicted, but he has argued against adding yet another large record type to DNS. That's a good argument but at the same time not very helpful. The problem here is that there are several other queries with large replies and you just need one for an attack. Then there's all of NTP, and so on. It's one of those problems likely to get worse before it gets better.
simoncion 11y ago
> It is kind of epic how DJB predicted this. That's not how I read the linked essay. The lesson I get from that is that until relatively recently it was trivial to poison DNS responses requested by most DNS servers, and that it's still quite possible if you have a "nearby" malicious machine. The CloudFlare essay appears to be talking about DDoS attacks via traffic amplification through large DNS queries. Yes they both involve DNS, but -AIUI- nether DNSSEC nor DNSCurve will fix the problem mentioned in the CloudFlare essay. Am I misunderstanding either essay?
- StreamBright 11y ago
  To be more specific he talks about it here: http://cr.yp.to/talks/2012.06.04/slides.pdf http://cr.yp.to/talks/2012.06.04/slides.pdf http://imgur.com/m6YCyG8 http://imgur.com/m6YCyG8
  - simoncion 11y ago
    > To be more specific... ITYM: "To actually link to a talk where he talks about the topic I thought he was talking about..." ;) But yeah, thanks for the links. That's good stuff.
    - StreamBright 11y ago
      Yep, copy paste fail the first link.
- jedisct1 11y ago
  DNSCrypt works around the amplification problem (for public resolvers) by requiring a UDP query to be at least a big as the response, or the response will be truncated.

xorcist 11y ago

That link is about source port randomization in DNS, which Bernstein was a proponent of and most software implement today. DDoS by DNS is something else entirely. The cookies that Bernstein advocate does not help here. Only ingress filtering helps, but it has to be implemented world wide before it useful, and not many bother unless forced to. That much was well known at the time, and not something Bernstein predicted, but he has argued against adding yet another large record type to DNS. That's a good argument but at the same time not very helpful. The problem here is that there are several other queries with large replies and you just need one for an attack. Then there's all of NTP, and so on. It's one of those problems likely to get worse before it gets better.

simoncion 11y ago

> It is kind of epic how DJB predicted this. That's not how I read the linked essay. The lesson I get from that is that until relatively recently it was trivial to poison DNS responses requested by most DNS servers, and that it's still quite possible if you have a "nearby" malicious machine. The CloudFlare essay appears to be talking about DDoS attacks via traffic amplification through large DNS queries. Yes they both involve DNS, but -AIUI- nether DNSSEC nor DNSCurve will fix the problem mentioned in the CloudFlare essay. Am I misunderstanding either essay?

StreamBright 11y ago
To be more specific he talks about it here: http://cr.yp.to/talks/2012.06.04/slides.pdf http://cr.yp.to/talks/2012.06.04/slides.pdf http://imgur.com/m6YCyG8 http://imgur.com/m6YCyG8
- simoncion 11y ago
  > To be more specific... ITYM: "To actually link to a talk where he talks about the topic I thought he was talking about..." ;) But yeah, thanks for the links. That's good stuff.
  - StreamBright 11y ago
    Yep, copy paste fail the first link.
jedisct1 11y ago
DNSCrypt works around the amplification problem (for public resolvers) by requiring a UDP query to be at least a big as the response, or the response will be truncated.