full-disclosure - Re: DNS bind attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 26 Jan 2012 20:15:36 +0100
From: "Roberto Navarro - TusProfesionales.es" <rnavarro@...profesionales.es>
To: <full-disclosure@...ts.grok.org.uk>
Subject: Re: DNS bind attacks

There's a lot written about this particular on Dns-Operations, NANOG and
other lists:

http://mailman.nanog.org/pipermail/nanog/2011-December/042562.html
https://lists.dns-oarc.net/pipermail/dns-operations/2011-December/007852.html

Also, it was published by dyndns staff some time ago:

http://dyn.com/active-incident-notification-recent-chinanetany-query-floods/

It's some kind of amplification attack, and you'll find a lot of information
on the mail archives.

----- Original Message ----- 
From: Gage Bystrom
To: J. von Balzac ; full-disclosure@...ts.grok.org.uk
Sent: Thursday, January 26, 2012 1:40 PM
Subject: Re: [Full-disclosure] DNS bind attacks

Other than the fact they may somehow notice this and start trying to autoban 
sites you should be fine. Since he is spoofing it would be hard for him to 
tell without trying it out on a box he controls. If anything gets autobanned 
you really need then just whitelist it, if you can think of such places 
before hand then go ahead and whitelist them now.
Just be aware in case its not a ddos but really part of some exploit of 
sorts, as owning a bind server is obviously very appealing. Now if any would 
be a good time to do a double check on your security measures but in all 
likelihood it seems like a fairly weak attack and your measures should be 
fine.
That or we are both missing some glaring piece of information.
On Jan 26, 2012 3:36 AM, "J. von Balzac" <jhm.balzac@...il.com> wrote:

I'm seeing a lot of hosts in my named logs (I mean log files, it's not
like I am naming my poop)

...ok... silly joke hehe

So anyway, named bind is reporting a lot of denied queries of type
'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which
is to immediately block the IPs for port 53 after as few as one denied
query) - but I want to warn server admins who haven't spotted both
these queries and other denied queries.

Common sense suggests that these hosts are probably spoofed IPs. Looks
like an effective way to ddos a host: request an arbitrary DNS record
with a spoofed IP and let the server reply to the spoofed IP in
whatever way. Do that with many hosts and there is your denial of
service.

A side effect is that when you block the IP, you're blocking something
that isn't really doing anything wrong as it's a spoofed IP

But ok, I'm not too sure of this so please shoot holes in my theory or
suggest better fixes/workarounds/...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/ 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/