5 ms·

I understand the issues with DNS reflection, but why are open resolvers the issue? Isn't the point of DNS to respond to requests with correct information? Sure

I understand the issues with DNS reflection, but why are open resolvers the issue? Isn't the point of DNS to respond to requests with correct information? Surely if random people can't connect to DNS resolvers and get information, they can't surf the net either? Someone has to resolve DNS for people for the internet to function, don't they?

yuliyp 14y ago
DNS runs over UDP, which means the source of requests for information can be spoofed. Also, the amount of data of a response is significantly larger than the request, so you can use DNS resolvers to send significantly more data to a victim than you yourself need to generate by sending DNS queries with your victim as the source IP.
- summerdown2 14y ago
  Yes, I understand the attack. My point is that somewhere, there have to be DNS servers that respond to public requests ... otherwise the internet will not work. Hence, some DNS servers have to be open. By saying it's openness that's the problem, we're blaming the victims, rather than the issue, which is that DNS is flawed. Simply moving to TCP would be better, surely?
  - AdrenalinMd 14y ago
    UDP doesn't require a handshake hence is easy to spoof unlike TCP where a full-duplex connection must be established for a successful connection.
    - summerdown2 14y ago
      Yes, that's my point. If we move to TCP we fix the issue. At the moment I can't see how closing open servers is a real fix.
      - pixl97 14y ago
        Moving from UDP back to TCP on large packets is a mixed bag. TCP is slow, very slow. At one time DNS packets were limited to 512 bytes and had to use TCP for more data, but over time the number of UDP packets over 512 bytes increased greatly. Going back to the smaller packet size would impact a large number of users with longer load times, especially on wireless devices. Closing open DNS servers isn't a real fix. The people who need to fix it are the lest likely to have a clue there is a problem in the first place.
andreasvc 14y ago
The open resolvers are the issue because they respond to anyone, which makes it possible to use them in an attack. Most DNS servers of ISPs will only respond to requests coming from their clients. Google (8.8.8.8) and OpenDNS are exceptions, but they will have measures to mitigate against these attacks.
- summerdown2 14y ago
  My point is that I think there's no way round some DNS servers having to respond to public requests. Do you have any details on how google or opendns solve the problem? I'm particularly interested in why their servers can't be used for reflection, because if there's an easy way, shouldn't we be asking the owners of open servers to do that rather than limiting IP access? In case this comes across as argumentative, please let me say that I am actually interested in this and am asking for information, not trying to make a point here. I really would like to understand the issue.
  - andreasvc 14y ago
    Well as I said, the majority of DNS servers are meant for a specific group of users, of a particular ISP or company, which can be filtered by IP. Google & OpenDNS are exceptions; I wouldn't know about their defense mechanisms and I'd imagine they prefer not to disclose them, but I suppose it might be similar to how credit card companies try to detect fraud by looking for unusual transactions. There's also non-recursive servers answering queries about a particular domain, they also answer to anyone but they answer only about their domains (authoritative). I think your point about trying to find a way for the open DNS resolvers to be protected but still open is moot, because there's really no reason for servers to be open to everyone (except for Google or OpenDNS who know what they're doing), these are just misconfigured servers of people who have no idea they can be abused. In my opinion the solution is for ISPs to actively block such open resolvers among their clients.
    - summerdown2 14y ago
      I take the point that a lot of these servers are just doing it by mistake, but do you not think that the more we allow only a few large conglomerate DNS servers, the more we fall prey to other issues with central directory services? Eg https://en.wikipedia.org/wiki/DNS_blocking#Criticism https://en.wikipedia.org/wiki/DNS_blocking#Criticism http://torrentfreak.com/how-to-unblock-the-pirate-bay-111004/ http://torrentfreak.com/how-to-unblock-the-pirate-bay-111004... One of the big advantages of DNS at the moment, surely, is its ability to be run by anyone?

yuliyp 14y ago

DNS runs over UDP, which means the source of requests for information can be spoofed. Also, the amount of data of a response is significantly larger than the request, so you can use DNS resolvers to send significantly more data to a victim than you yourself need to generate by sending DNS queries with your victim as the source IP.

summerdown2 14y ago
Yes, I understand the attack. My point is that somewhere, there have to be DNS servers that respond to public requests ... otherwise the internet will not work. Hence, some DNS servers have to be open. By saying it's openness that's the problem, we're blaming the victims, rather than the issue, which is that DNS is flawed. Simply moving to TCP would be better, surely?
- AdrenalinMd 14y ago
  UDP doesn't require a handshake hence is easy to spoof unlike TCP where a full-duplex connection must be established for a successful connection.
  - summerdown2 14y ago
    Yes, that's my point. If we move to TCP we fix the issue. At the moment I can't see how closing open servers is a real fix.
    - pixl97 14y ago
      Moving from UDP back to TCP on large packets is a mixed bag. TCP is slow, very slow. At one time DNS packets were limited to 512 bytes and had to use TCP for more data, but over time the number of UDP packets over 512 bytes increased greatly. Going back to the smaller packet size would impact a large number of users with longer load times, especially on wireless devices. Closing open DNS servers isn't a real fix. The people who need to fix it are the lest likely to have a clue there is a problem in the first place.

andreasvc 14y ago

The open resolvers are the issue because they respond to anyone, which makes it possible to use them in an attack. Most DNS servers of ISPs will only respond to requests coming from their clients. Google (8.8.8.8) and OpenDNS are exceptions, but they will have measures to mitigate against these attacks.

summerdown2 14y ago
My point is that I think there's no way round some DNS servers having to respond to public requests. Do you have any details on how google or opendns solve the problem? I'm particularly interested in why their servers can't be used for reflection, because if there's an easy way, shouldn't we be asking the owners of open servers to do that rather than limiting IP access? In case this comes across as argumentative, please let me say that I am actually interested in this and am asking for information, not trying to make a point here. I really would like to understand the issue.
- andreasvc 14y ago
  Well as I said, the majority of DNS servers are meant for a specific group of users, of a particular ISP or company, which can be filtered by IP. Google & OpenDNS are exceptions; I wouldn't know about their defense mechanisms and I'd imagine they prefer not to disclose them, but I suppose it might be similar to how credit card companies try to detect fraud by looking for unusual transactions. There's also non-recursive servers answering queries about a particular domain, they also answer to anyone but they answer only about their domains (authoritative). I think your point about trying to find a way for the open DNS resolvers to be protected but still open is moot, because there's really no reason for servers to be open to everyone (except for Google or OpenDNS who know what they're doing), these are just misconfigured servers of people who have no idea they can be abused. In my opinion the solution is for ISPs to actively block such open resolvers among their clients.
  - summerdown2 14y ago
    I take the point that a lot of these servers are just doing it by mistake, but do you not think that the more we allow only a few large conglomerate DNS servers, the more we fall prey to other issues with central directory services? Eg https://en.wikipedia.org/wiki/DNS_blocking#Criticism https://en.wikipedia.org/wiki/DNS_blocking#Criticism http://torrentfreak.com/how-to-unblock-the-pirate-bay-111004/ http://torrentfreak.com/how-to-unblock-the-pirate-bay-111004... One of the big advantages of DNS at the moment, surely, is its ability to be run by anyone?