full-disclosure - Re: DNS bind attacks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <29E23E51-8FBC-43EE-8635-1ECDB5FA368D@gmail.com>
Date: Thu, 26 Jan 2012 13:17:21 -0500
From: Chris Granger <chrisgrangerx@...il.com>
To: "J. von Balzac" <jhm.balzac@...il.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>,
	Security Basics <security-basics@...urityfocus.com>
Subject: Re: DNS bind attacks

Your theory's likely correct - do you allow external IPs to make recursive queries to your server? 

>>From (this would be a way to corroborate & I can't say it any better): http://www.gossamer-threads.com/lists/nanog/users/143319

"The isc.org record is commonly used in reflection attacks because the size of the record is so large, so the amplification factor is greatly increased. Can you check to see if +edns=0 was set in the query? That would be a sure sign this is related... "

Sent from my iPhone

On Jan 26, 2012, at 6:35 AM, "J. von Balzac" <jhm.balzac@...il.com> wrote:

> I'm seeing a lot of hosts in my named logs (I mean log files, it's not
> like I am naming my poop)
> 
> ...ok... silly joke hehe
> 
> So anyway, named bind is reporting a lot of denied queries of type
> 'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which
> is to immediately block the IPs for port 53 after as few as one denied
> query) - but I want to warn server admins who haven't spotted both
> these queries and other denied queries.
> 
> Common sense suggests that these hosts are probably spoofed IPs. Looks
> like an effective way to ddos a host: request an arbitrary DNS record
> with a spoofed IP and let the server reply to the spoofed IP in
> whatever way. Do that with many hosts and there is your denial of
> service.
> 
> A side effect is that when you block the IP, you're blocking something
> that isn't really doing anything wrong as it's a spoofed IP
> 
> But ok, I'm not too sure of this so please shoot holes in my theory or
> suggest better fixes/workarounds/...
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/