3 ms·

The attack as specified by the article would be pretty ineffective as recursive DNS servers tend to have a cache. So only the first request would hit the target

The attack as specified by the article would be pretty ineffective as recursive DNS servers tend to have a cache. So only the first request would hit the target DNS server. Also, you can definitely do this with authoritative servers only, which is why only egress filtering by ISPs is a permanent solution to the problem. However, there are way fewer authoritative DNS servers out there than there are open recursors and they are better managed. So an attack would never grow to the scale this one has grown to using only authoritative servers.

ricardobeat 14y ago
You got me confused for a minute. So I assume in an actual attack you'll rotate the domains being requested?
- entropy_ 14y ago
  No, the attack does not work by overloading target DNS servers. There is no benefit in asking a recursive DNS server to make a DNS request for you to overload another DNS server, you could just make that request yourself(or with whatever botnet you're using). The attack works by sending a recursive DNS server a request with a spoofed source IP. Namely, you make the recursive DNS server think your target is making the request. While a typical DNS query consists of a 64byte UDP packet, a reply can be much much lengthier(it can go well over 1KB). So say you have a botnet with a total bandwidth of 1Gb/s. Each request you make(64bytes) will result in, say, 1KB being sent by the DNS server to your target although the server thinks it is sending it to you. That results in a 16x amplification of the amount of data you are sending the target's way. So instead of flooding your target with 1Gb/s of data, you are flooding it with 16Gb/s of DNS replies. The only permanent solution to this problem(though it is discussed elsewhere in this thread why this is impractical) is for all(or almost all) ISPs to have egress filtering. That is, that they would drop all packets sent from their networks with a source IP that is not on their networks. This would make it impossible to fool a recursive DNS server into sending the reply to the wrong IP. Since this is very hard to do(ISPs have zero incentive to do egress filtering, and we can't even locate the ones from whose networks these attacks are originating to shame them into doing it) the pursued solution is the easier one of locating and closing publicly open DNS recursors. This would still allow DNS amplification attacks using authoritative servers, but they would be much more limited in scope.
  - bradleyjg 14y ago
    Thanks for the great explanation. So if I understand correctly, the problems with the DNS amplification attack using only authoritative nameservers are: a) You have to keep track of which name to request from which server b) You can't optimize for a particularly large response c) Operators of authoritative name servers are likely to be more sophisticated and therefore have egress filtering. d) There aren't as many authoritative nameservers as open recursive servers (?)
    - entropy_ 14y ago
      All points correct except c). Egress filtering happens on the ISP side, there's nothing the DNS server can do once it gets a request with a spoofed source IP. But since operators of authoritative name servers are more likely to be sophisticated they could notice an ongoing attack and throttle down the replies without negatively affect anything else. In fact, that protection could be built into the server code. Simply throttle consecutive replies to the same requester to a sane amount. There is no legitimate use-case where the same person would make a humongous amount of consecutive requests from an authoritative server as responses are usually cached. If that's done, an attacker wouldn't be able to coerce authoritative servers into flooding a target, they would just send replies at a slow rate(after an initial speedy response) and no significant amplification would occur. As you state in d) there are a lot of open recursive servers out there that are unlikely to be updated or managed by someone sophisticated enough to respond to attacks like this. Whereas this is less likely with authoritative servers.
spc476 14y ago
I'm not so sure about that. Even with recursion turned off, the server still responds with an error packet. While the error pack is small compared to an actual answer, hit enough DNS servers (authoritative or not) and you can still generate quite a bit of traffic.
marshray 14y ago
I don't think egress filtering is either practical or the only solution to this problem. I believe are other solutions, better ones that don't involve traffic filtering and threatening the open nature of the internet.

ricardobeat 14y ago

You got me confused for a minute. So I assume in an actual attack you'll rotate the domains being requested?

entropy_ 14y ago
No, the attack does not work by overloading target DNS servers. There is no benefit in asking a recursive DNS server to make a DNS request for you to overload another DNS server, you could just make that request yourself(or with whatever botnet you're using). The attack works by sending a recursive DNS server a request with a spoofed source IP. Namely, you make the recursive DNS server think your target is making the request. While a typical DNS query consists of a 64byte UDP packet, a reply can be much much lengthier(it can go well over 1KB). So say you have a botnet with a total bandwidth of 1Gb/s. Each request you make(64bytes) will result in, say, 1KB being sent by the DNS server to your target although the server thinks it is sending it to you. That results in a 16x amplification of the amount of data you are sending the target's way. So instead of flooding your target with 1Gb/s of data, you are flooding it with 16Gb/s of DNS replies. The only permanent solution to this problem(though it is discussed elsewhere in this thread why this is impractical) is for all(or almost all) ISPs to have egress filtering. That is, that they would drop all packets sent from their networks with a source IP that is not on their networks. This would make it impossible to fool a recursive DNS server into sending the reply to the wrong IP. Since this is very hard to do(ISPs have zero incentive to do egress filtering, and we can't even locate the ones from whose networks these attacks are originating to shame them into doing it) the pursued solution is the easier one of locating and closing publicly open DNS recursors. This would still allow DNS amplification attacks using authoritative servers, but they would be much more limited in scope.
- bradleyjg 14y ago
  Thanks for the great explanation. So if I understand correctly, the problems with the DNS amplification attack using only authoritative nameservers are: a) You have to keep track of which name to request from which server b) You can't optimize for a particularly large response c) Operators of authoritative name servers are likely to be more sophisticated and therefore have egress filtering. d) There aren't as many authoritative nameservers as open recursive servers (?)
  - entropy_ 14y ago
    All points correct except c). Egress filtering happens on the ISP side, there's nothing the DNS server can do once it gets a request with a spoofed source IP. But since operators of authoritative name servers are more likely to be sophisticated they could notice an ongoing attack and throttle down the replies without negatively affect anything else. In fact, that protection could be built into the server code. Simply throttle consecutive replies to the same requester to a sane amount. There is no legitimate use-case where the same person would make a humongous amount of consecutive requests from an authoritative server as responses are usually cached. If that's done, an attacker wouldn't be able to coerce authoritative servers into flooding a target, they would just send replies at a slow rate(after an initial speedy response) and no significant amplification would occur. As you state in d) there are a lot of open recursive servers out there that are unlikely to be updated or managed by someone sophisticated enough to respond to attacks like this. Whereas this is less likely with authoritative servers.

spc476 14y ago

I'm not so sure about that. Even with recursion turned off, the server still responds with an error packet. While the error pack is small compared to an actual answer, hit enough DNS servers (authoritative or not) and you can still generate quite a bit of traffic.

marshray 14y ago

I don't think egress filtering is either practical or the only solution to this problem. I believe are other solutions, better ones that don't involve traffic filtering and threatening the open nature of the internet.