lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 26 Jan 2012 12:59:09 -0500 From: Jeffrey Walton <noloader@...il.com> To: "J. von Balzac" <jhm.balzac@...il.com> Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>, Security Basics <security-basics@...urityfocus.com> Subject: Re: DNS bind attacks What's the query. Could it be related to http://www.isc.org/software/bind/advisories/cve-2011-4313? On Thu, Jan 26, 2012 at 6:35 AM, J. von Balzac <jhm.balzac@...il.com> wrote: > I'm seeing a lot of hosts in my named logs (I mean log files, it's not > like I am naming my poop) > > ...ok... silly joke hehe > > So anyway, named bind is reporting a lot of denied queries of type > 'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which > is to immediately block the IPs for port 53 after as few as one denied > query) - but I want to warn server admins who haven't spotted both > these queries and other denied queries. > > Common sense suggests that these hosts are probably spoofed IPs. Looks > like an effective way to ddos a host: request an arbitrary DNS record > with a spoofed IP and let the server reply to the spoofed IP in > whatever way. Do that with many hosts and there is your denial of > service. > > A side effect is that when you block the IP, you're blocking something > that isn't really doing anything wrong as it's a spoofed IP > > But ok, I'm not too sure of this so please shoot holes in my theory or > suggest better fixes/workarounds/... > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists