bugtraq - RE: recursive DNS servers DDoS as a growing DDoS problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 03 Apr 2006 07:05:57 +0200
From: Måns Nilsson <mansaxel@...et.se>
To: "Geo." <geoincidents@....net>, bugtraq@...urityfocus.com
Subject: RE: recursive DNS servers DDoS as a growing DDoS problem

--On den 30 mars 2006 16.08.51 -0500 "Geo." <geoincidents@....net> wrote:

> Don't you think creating a control point like that is dangerous?
> Especially dangerous when it's DNS which runs virtually every function on
> the internet?

The control point is there already, as has been demonstrated by several
attacks on DNS data. 

If we were to ignore the problem of open recursive servers, there would be
a rush to implement draconian, ineffective countermeasures like packet
filters. It would be a very bad thing, just like the stupid port 25 blocks
are. That must be avoided and the end-to-end capability of the Internet
must be preserved. (I think we are in agreement here.)

> It's not a conspiracy theory, it's fact, if you create a control like that
> someone is going to want to control it. I suggest only that we consider
> this along with everything else.

If you have these concerns, I suggest you work with the available,
standardised, implemented methods of verifying that DNS data is correct
(ie. DNSSEC and TSIG for various parts of the infrastructure.) instead of
pushing your head down in the sand even further believing TCP  or open
access to the rest of the net would make some difference in credibility for
DNS messages. At least one TLD (se) has DNSSEC in production, large amounts
of european IP address space have it, courtesy of RIPE.

-- 
Måns Nilsson                     Systems Specialist
+46 70 681 7204   cell                       KTHNOC
+46 8 790 6518  office                  MN1334-RIPE

Inside, I'm already SOBBING!

Content of type "application/pgp-signature" skipped