4 ms·

How will DNS resolvers be changed to prevent this? Doesn't removing this feature undo an important function of the DNS system?

• mdpye 14y ago
  You don't change the resolver. ISPs need to drop UDP packets leaving their networks where the (spoofed) headers declare that they did not originate there. That way an attacker can't spoof the originator to have the responses directed at someone else. Edit: clarity on actual vs declared origin
  • dasil003 14y ago
    It also seems like a tractable problem in that upstream providers can test for the vulnerability and shut down uplinks for non-compliant customers.
  • jiggy2011 14y ago
    That would cost some amount of money for an ISP to implement, and you need to get the major ISPs (most of them are not in the USA, many are in places like China) to all apply it.
• 16s 14y ago
  Linux or BSD based DNS servers can rate limit with iptables, pf, etc. to mitigate this a great deal.