bugtraq - Re: recursive DNS servers DDoS as a growing DDoS problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <000801c651f6$221b3190$0401a8c0@cheshire>
Date: Mon, 27 Mar 2006 18:27:49 -0500
From: "mike davis" <phar@...nedcoder.org>
To: "Geo." <geoincidents@....net>, <bugtraq@...urityfocus.com>
Subject: Re: recursive DNS servers DDoS as a growing DDoS problem


> If you have a 20,000 bot botnet and each bot has 2 defined recursive dns
> servers that it is allowed to use and these bots are on the local subnet 
> (ie
> BCP38 is implimented at the gateway but not at every router) then how
> exactly is locking down recursive servers so you can only use yours going 
> to
> solve anything?

uh... caching maybe?... the second field of your answer section when using 
dig..

> To fix DNS we would have to eliminate it's use of UDP which means pretty
> much all internet software would need to be rewritten, that is an
> unrealistic goal.

no, its not, and it doesnt require that all internet sofware be rewritten, 
it means that they either need to be
recompiled, or just have the dynamicly linked library they use for dns 
resolution to be replaced..

>  Locking down recursive servers may increase the number of
> machines required to create a flood but again a large botnet will have no
> problem so that's no solution either. BCP38 will accomplish the same
> ineffective goal but at least has the added potential to reduce non DNS
> related spoofed attacks at the same time making it easier to at least 
> track
> down the sources of a distributed flood at least to the provider level if
> not to the exact IP.

i think its pretty obvious that locking down dns servers at least brings the 
DNS attacks down to the same problem weve always had..
that being good old fashioned udp packeting. and at that point.. why bother 
using dns..

-phar