4 ms·
" Just be sure to set high TTL for the records so your DNS server does not collapse under the enormous volume." The attacker, noticing your round-robin approac
by mrtron 16y ago
" Just be sure to set high TTL for the records so your DNS server does not collapse under the enormous volume."
The attacker, noticing your round-robin approach, decides to drop the DNS server and then only has one host to deal with.
There are a lot of weak points that can be attacked. Certain sites will have features that can be taken advantage of. If you have a long timeout/keepalive, the attacker could launch lots of quick requests with no proper tear-down. If you have a zillion servers setup like this - perhaps they can take out a major link before the traffic even gets to you.
I also don't think this is a new approach - unfortunately it is much harder to stop attacks than to create various approaches. The number of compromised machines is just too high - that is the ultimate solution.
- tptacek 16y agoAre people actually seeing their DNS servers collapse under load? DNS servers --- even BIND, which, don't use BIND --- are very, very fast.
- laz 16y agoCompared to HTTP DNS is crazy cheap to serve, but you'll still end up bottlenecking on the pps rate of your NIC and OS. Everybody optimizes for high throughput and ignores small packets. Speaking of DNS DDoS, DNS Made Easy saw a 40Gbit DNS DDoS a few weeks back.
- JoachimSchipper 16y agoTimeouts would presumably be taken care of when setting up the proxies. Major DNS providers are used to getting DDoS'ed, and will typically be fine (not always, but it's a lot harder to drop them than to drop any random server). I agree that there's probably a way to break things; but an attacker would need to actually do some work for most of them (e.g. create lots of accounts?)
- drv 16y agoNot to mention that the attacker's DNS resolver could merely ignore the TTL and bombard your DNS server - if that's the weakest link, why even bother with the rest?
- JoachimSchipper 16y agoBecause quite a few companies outsource DNS, and attacking a DNS provider involves many companies. Not to mention the fact that most DNS providers have been attacked before...