bugtraq - Re: recursive DNS servers DDoS as a growing DDoS problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4432EE7E.7020202@hpcisp.com>
Date: Tue, 04 Apr 2006 18:09:02 -0400
From: Jim Pingle <jim@...isp.com>
To: "Geo." <geoincidents@....net>
Cc: bugtraq@...urityfocus.com
Subject: Re: recursive DNS servers DDoS as a growing DDoS problem

Geo. wrote:
>> We have done just this (block inbound udp/53) to certain subnets due to a
>> rash of CPEs that happily proxy DNS, including recursive queries,
>> from their WAN side.
> 
> What devices? Is this a default or something customers are configuring?

Just about every Siemens/Efficient *DSL router (5851, 5871, 5890, some
others) I have seen does this by default. During one attack I logged into a
router and changed the DNS servers used for DHCP from both, to one, to the
other, and watched its traffic flow exactly where I pointed the DNS servers.

These routers also have a bad habit of hijacking DNS requests for anything
in the form of <routername>.anydomain.com. Even if the DNS request is sent
to an ISP name server, it will still return a record pointing to its own LAN
IP when queried for, i.e. foo.bork.com and foo.microsoft.com if you named
the router "foo".

It's not only done by default, it's not a configurable behavior as far as
I've been able to find. The fix we were supplied with was to block inbound
udp/53 using the router's internal IP filtering, and to name the router
something unique (i.e. a customer's order number).

Jim