full-disclosure - Re: recursive DNS servers DDoS as a growingDDoSproblem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1142346520.4999.9.camel@localhost>
Date: Tue Mar 14 15:44:33 2006
From: keith.morgan at terradon.com (Keith Morgan)
Subject: Re: recursive DNS servers DDoS as a
	growingDDoSproblem

I had an off-list request for a packet capture or log entries of
examples.

http://www.criticalstop.com/malicious_dns.txt

Only the IP of our affected DNS server is sanitized.  But this should
put to rest questions about fragmentation, etc...

The DNS server providing the cached response is pretty typical of DNS
servers out there in the world.

There clearly is an attack amplification factor.  The exact magnitude
can be gleaned from the packet capture.

On Mon, 2006-03-13 at 16:30 -0500, Keith T. Morgan wrote:
> FWIW, we've seen the exact activity you outline below in the wild.
> In
> this case, it was associated with spam.
> 
> 
**********************************************************************************************
IMPORTANT: The contents of this email and any attachments are confidential. They are intended for the 
named recipient(s) only.
If you have received this email in error, please notify the system manager or the sender immediately and do 
not disclose the contents to anyone or make copies thereof.
*** eSafe scanned this email for viruses, vandals, and malicious content. ***
**********************************************************************************************