bugtraq - RE: Re: recursive DNS servers DDoS as a growing DDoSproblem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E9687DBE2FCDA64BA77282F7E36BADBC030EEC90@mail.terradon.com>
Date: Mon, 13 Mar 2006 16:30:25 -0500
From: "Keith T. Morgan" <keith.morgan@...radon.com>
To: "Geo." <geoincidents@....net>,<bugtraq@...urityfocus.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: RE: Re: recursive DNS servers DDoS as a growing
	DDoSproblem

FWIW, we've seen the exact activity you outline below in the wild.   In
this case, it was associated with spam.

-----Original Message-----
From: Geo. [mailto:geoincidents@....net] 
Sent: Wednesday, March 08, 2006 1:27 PM
To: bugtraq@...urityfocus.com
Cc: full-disclosure@...ts.grok.org.uk
Subject: RE: [Full-disclosure] Re: recursive DNS servers DDoS as a
growing DDoSproblem

>>In the scenario you describe, I cannot see any actual amplification...

I'll give you a senario where you can see.

lets say you have 2 name servers that are local to you.

I setup a domain, example.com. In this domain I create a text record
which is 100K in length, I don't know, perhaps I paste the source code
to decss in it, whatever it's a big text record.

Now I simply spoof a UDP packet using your IP address as the source
address and send it to both of your dns servers. This packet is a query
for the example.com text record. I have now sent two very small packets
and you have received 200K of traffic. That's the amplification, one
small udp packet, one large text record in return.

Note, I don't have to use your local servers, but this way it makes it
more fun to troubleshoot because it looks like you are the cause of your
own flooding..

Geo.
**********************************************************************************************
IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the 
named recipient(s) only.
If you have received this email in error, please notify the system manager or the sender immediately and do 
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. ***
**********************************************************************************************

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/