5 ms·

I just had an idea: if you control your own name server I believe you could use a BIND view to send all their own traffic to themselves based on the source addr

by pera 6y ago

I just had an idea: if you control your own name server I believe you could use a BIND view to send all their own traffic to themselves based on the source address. By the way, if someone discovers how to trigger this issue it would be easy to use it as a DOS pseudo-botnet.

gerdesj 6y ago
Nice idea, I like the thinking. I'll tuck that away for use later. PowerDNS has LUA built in amongst a few other things. My stack of projects to do is growing at a hell of a rate and I'm not popping them off the stack fast enough.
- verdverm 6y ago
  I know the feeling, it's one of the reasons I'm working on https://github.com/hofstadter-io/hof https://github.com/hofstadter-io/hof Check out the code generation parts and modules, they are the most mature. We have HRDs (like CRDs in k8s for anything) and a scripting language between bash and Python coming out soon too.
  - gerdesj 6y ago
    I've tried to work out what your project does but I'm none the wiser. GEB is prominent on my bookshelf. I'm a syadmin and I got as far as "hollow wold" in Go or was it "Hail Marrow"? Can't remember. I've checked out your repo for a look over tomorrow when I'm cough sober!
    - verdverm 6y ago
      Stop by gitter and I'd be happy to explain more
foobiekr 6y ago
if only there was a way to accidentally amplify that.
gorgoiler 6y ago
Something about this idea sits uncomfortably with me. I also just had an idea / thought experiment based on your idea. We think of net neutrality as being for carriers and ISPs, but you could see it applied to a publicly accessible DNS service too. These DNS service providers are just as much part of the core service of the Internet as anyone else. It’s not a huge leap to require that those who operate a publicly accessible DNS service are bound by the same spirit of the regulations: that the infrastructure must not discriminate based on who is using it. It’s different to operating a discriminatory firewall. DNS is a cacheable public service with bad consequences if poisonous data ends up in the system. Fiddling with DNS like this doesn’t seem like a good idea. Too much weird and bad stuff could go wrong. Another analogy would be to the use of encryption on amateur radio. It seems like an innocuously good idea, but the radio waves were held open in public trust for public use. If you let them be used for a different (though arguably a more useful purpose) then the resource ends up being degraded. Also along these lines of thought [begin irony mode]: FCC fines for DNS wildcard abuse / usage.
- inopinatus 6y ago
  Principled neutrality is fine for acceptable use. There’s no moral quandary in closing the door to abusers.
  - zdragnar 6y ago
    Isn't that the argument that providers make for wanting to meter usage? I.e. video streamers, torrenters and netflix and the like are 'abusing' the network by using a disproportionate amount of their capacity / bandwidth? I guess my point is that "abuse" in this sense is pretty subjective.
    - inopinatus 6y ago
      Not really, those things are easy to contrast. Network providers have always been comfortable blackholing DoS routes, and it’s never been controversial. That’s clearly distinct from those wanting to double-dip on transport revenues for routine traffic. The difference is in whether both endpoints want the traffic, not whether (or on what basis) the enabling infrastructure wants to bear it.
raverbashing 6y ago
You could just probably send an HTTP redirect to their own site, no need to play with DNS for that
- tempestn 6y ago
  Except then you'd still have to deal with all the traffic.
- mint2 6y ago
  Probably better to find the highest level FB employees personal site that you can and send the million requests from fb there.
mszcz 6y ago
I had a different idea. Maybe you could craft a zip-bomb response. The bot would fetch the small gzipped content and upon extraction discover it was GBs of data? Not sure that's possible here, when responding to a request, but that would surely turn the admins attention to it.
- narrowtux 6y ago
  If their client asks for gzip compression of the http traffic, you could do it.
- Nextgrid 6y ago
  Here's an example of things you can do against malicious crawlers: http://www.hackerfactor.com/blog/index.php?/archives/762-Attacked-Over-Tor.html http://www.hackerfactor.com/blog/index.php?/archives/762-Att....
  - touristtam 6y ago
    fascinating read. :)
    - mszcz 6y ago
      It is!
  - Jazgot 6y ago
    Thanks a lot! I've spent like 2h now reading his blog. Just amazing.

by pera 6y ago

gerdesj 6y ago

Nice idea, I like the thinking. I'll tuck that away for use later. PowerDNS has LUA built in amongst a few other things. My stack of projects to do is growing at a hell of a rate and I'm not popping them off the stack fast enough.

verdverm 6y ago
I know the feeling, it's one of the reasons I'm working on https://github.com/hofstadter-io/hof https://github.com/hofstadter-io/hof Check out the code generation parts and modules, they are the most mature. We have HRDs (like CRDs in k8s for anything) and a scripting language between bash and Python coming out soon too.
- gerdesj 6y ago
  I've tried to work out what your project does but I'm none the wiser. GEB is prominent on my bookshelf. I'm a syadmin and I got as far as "hollow wold" in Go or was it "Hail Marrow"? Can't remember. I've checked out your repo for a look over tomorrow when I'm cough sober!
  - verdverm 6y ago
    Stop by gitter and I'd be happy to explain more

foobiekr 6y ago

if only there was a way to accidentally amplify that.

gorgoiler 6y ago

Something about this idea sits uncomfortably with me. I also just had an idea / thought experiment based on your idea. We think of net neutrality as being for carriers and ISPs, but you could see it applied to a publicly accessible DNS service too. These DNS service providers are just as much part of the core service of the Internet as anyone else. It’s not a huge leap to require that those who operate a publicly accessible DNS service are bound by the same spirit of the regulations: that the infrastructure must not discriminate based on who is using it. It’s different to operating a discriminatory firewall. DNS is a cacheable public service with bad consequences if poisonous data ends up in the system. Fiddling with DNS like this doesn’t seem like a good idea. Too much weird and bad stuff could go wrong. Another analogy would be to the use of encryption on amateur radio. It seems like an innocuously good idea, but the radio waves were held open in public trust for public use. If you let them be used for a different (though arguably a more useful purpose) then the resource ends up being degraded. Also along these lines of thought [begin irony mode]: FCC fines for DNS wildcard abuse / usage.

inopinatus 6y ago
Principled neutrality is fine for acceptable use. There’s no moral quandary in closing the door to abusers.
- zdragnar 6y ago
  Isn't that the argument that providers make for wanting to meter usage? I.e. video streamers, torrenters and netflix and the like are 'abusing' the network by using a disproportionate amount of their capacity / bandwidth? I guess my point is that "abuse" in this sense is pretty subjective.
  - inopinatus 6y ago
    Not really, those things are easy to contrast. Network providers have always been comfortable blackholing DoS routes, and it’s never been controversial. That’s clearly distinct from those wanting to double-dip on transport revenues for routine traffic. The difference is in whether both endpoints want the traffic, not whether (or on what basis) the enabling infrastructure wants to bear it.

raverbashing 6y ago

You could just probably send an HTTP redirect to their own site, no need to play with DNS for that

tempestn 6y ago
Except then you'd still have to deal with all the traffic.
mint2 6y ago
Probably better to find the highest level FB employees personal site that you can and send the million requests from fb there.

mszcz 6y ago

I had a different idea. Maybe you could craft a zip-bomb response. The bot would fetch the small gzipped content and upon extraction discover it was GBs of data? Not sure that's possible here, when responding to a request, but that would surely turn the admins attention to it.

narrowtux 6y ago
If their client asks for gzip compression of the http traffic, you could do it.
Nextgrid 6y ago
Here's an example of things you can do against malicious crawlers: http://www.hackerfactor.com/blog/index.php?/archives/762-Attacked-Over-Tor.html http://www.hackerfactor.com/blog/index.php?/archives/762-Att....
- touristtam 6y ago
  fascinating read. :)
  - mszcz 6y ago
    It is!
- Jazgot 6y ago
  Thanks a lot! I've spent like 2h now reading his blog. Just amazing.