4 ms·
Is it just me or does it seem like this attack will be self-defeating? They are relying on DNS servers to serve responses in order to make DNS servers stop serv
by amatus 15y ago
Is it just me or does it seem like this attack will be self-defeating? They are relying on DNS servers to serve responses in order to make DNS servers stop serving responses.
- aphyr 15y agoNo; the root nameservers have fixed IPs. Those IP addresses, and those of the vulnerable DNS servers to be used as reflectors, can be written down beforehand.
- sp332 15y agoThe problem is that, in the DNS spoof attack, the DNS reflectors have to have some data to send "back" to the spoofed IP. If the root servers are down, the reflectors won't have any data to send back, so the flood will stop as the reflectors' caches expire.
- amatus 15y agoSo it's not just me. Thanks.
- aphyr 15y agoPossibly. I haven't read the particular technique they're planning to use here, but I recall some old attacks against Bind relied on query reflection, which might work in the absence of cached data.
- icebraining 15y agoAs far as I know, they should still send a SERVFAIL response if they are unable to contact the authoritative servers.
- deleted 15y ago[deleted]