bugtraq - Re: recursive DNS servers DDoS as a growing DDoS problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <44314E8E.3000405@nostalgeek.com>
Date: Mon, 03 Apr 2006 12:34:22 -0400
From: Simon Boulet <simon@...talgeek.com>
To: gboyce <gboyce@...belly.com>
Cc: "Geo." <geoincidents@....net>, bugtraq@...urityfocus.com
Subject: Re: recursive DNS servers DDoS as a growing DDoS problem

gboyce wrote:
>
> I haven't heard anyone talk about requiring that users use their ISP's 
> DNS server.  Just that they should not be able to use any random DNS 
> server on the internet.
>
> What is stopping you from running your own local DNS server?  My 
> system at home runs named in a configuration that allows any systems 
> on my local network to query from it.  That's what I use as my 
> authoritative nameserver.
>
> -- 
> Greg
>

People tend to forget that authoritative nameservers can also be used if 
you know what zone to query for. How about sending spoofed packets to 
ns1.msft.net asking for microsoft.com?

Amplification attacks can be performed on any UDP service that responds 
with a reply packet larger than the initial query packet.

All DNS servers are at risk, some servers will produce lower 
amplification factors than others.

Simon