full-disclosure - DNS Amplification Attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <441B3178.9000706@linuxbox.org>
Date: Fri Mar 17 23:52:11 2006
From: ge at linuxbox.org (Gadi Evron)
Subject: DNS Amplification Attacks

In this paper we address in detail how the recent DNS DDoS attacks work.
How they abuse name servers, EDNS, the recursive feature and UDP packet 
spoofing, as well as how the amplification effect works.

Our study is based on packet captures (we provide with samples) and logs 
from attacks on different networks reported to have a volume of 2.8Gbps. 
One of these networks indicated some attacks have reached as high as 
10Gbps and used as many as 140,000 exploited name servers.

In the conclusions we also discuss some remediation suggestions.

Given recent events, we have been encouraged to make this text available 
at this time.

URL: http://www.isotf.org/news/DNS-Amplification-Attacks.pdf

Please note that this version of this paper is prior to submission for 
publication and that the final version may see significant revisions.

Thanks,

Randy Vaughn and Gadi Evron.