full-disclosure - Re: DNS bind attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAH8yC8==rPnAVOjg8w-Dz+B=kkA_z8E5yXCtTzbCMGifB_EbSg@mail.gmail.com>
Date: Thu, 26 Jan 2012 12:59:09 -0500
From: Jeffrey Walton <noloader@...il.com>
To: "J. von Balzac" <jhm.balzac@...il.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>,
	Security Basics <security-basics@...urityfocus.com>
Subject: Re: DNS bind attacks

What's the query. Could it be related to
http://www.isc.org/software/bind/advisories/cve-2011-4313?

On Thu, Jan 26, 2012 at 6:35 AM, J. von Balzac <jhm.balzac@...il.com> wrote:
> I'm seeing a lot of hosts in my named logs (I mean log files, it's not
> like I am naming my poop)
>
> ...ok... silly joke hehe
>
> So anyway, named bind is reporting a lot of denied queries of type
> 'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which
> is to immediately block the IPs for port 53 after as few as one denied
> query) - but I want to warn server admins who haven't spotted both
> these queries and other denied queries.
>
> Common sense suggests that these hosts are probably spoofed IPs. Looks
> like an effective way to ddos a host: request an arbitrary DNS record
> with a spoofed IP and let the server reply to the spoofed IP in
> whatever way. Do that with many hosts and there is your denial of
> service.
>
> A side effect is that when you block the IP, you're blocking something
> that isn't really doing anything wrong as it's a spoofed IP
>
> But ok, I'm not too sure of this so please shoot holes in my theory or
> suggest better fixes/workarounds/...
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/