full-disclosure - Re: [FD] DDos Attack To Drop The Internet

Open Source and information security mailing list archives

Message-Id: <1444081986.1546226.402097385.0995E7E1@webmail.messagingengine.com>
Date: Tue, 06 Oct 2015 07:53:06 +1000
From: James Hodgkinson <yaleman@...etek.net>
To: Jeffrey Roberts <jeffrey.l.roberts@...il.com>, fulldisclosure@...lists.org
Subject: Re: [FD] DDos Attack To Drop The Internet

Given enough bandwidth and a unique idea, anything is possible, it is
true. 

You provided a 2MB text list of DNS servers, approximately 200,000 of
them. They sit across most of the v4 IP ranges available (and some IPV6
ones). This means upstream links won't likely be saturated, and
filtering can likely be done on the server based on heuristics.

If you're going to ask for 100% random non-existent domains you're easy
to beat - if( failed_request() > 99% ) { drop_packet() }. If you're
going to ask for TLDs that exist, they're already cached by anyone
running a half-decent server, and they're going to send you elsewhere.
You might cause issues for individual downstream ranges as people get
heavy-handed with filtering, but you've included google's servers in
there and I'm guessing the roots are there too. They're anycast and
backed by some crazy bandwidth.

Of course it might work once, for a short time, but you've just told
some spectacular engineers out there to think about this problem, and
they've definitely already considered it ;) 

James

On Tue, 6 Oct 2015, at 01:39, Jeffrey Roberts wrote:
> If you were to have a botnet which were to flood random DNS queries
> for domains that did not exist to the list of DNS servers hosted on
> http://public-dns.tk/nameservers-all.txt then the root dns servers and
> the tld dns servers would be overwhelmed without any way to filter the
> packets, if they were to filter the packets of the DNS servers, they
> themselves would be turning off DNS, hence they can not do that... If
> the botnet only hits the DNS servers on the list a few times,
> filtering those packets would be insignificant. This attack should in
> essence turn off DNS for the world, hence, turning off the internet as
> the public knows it today.
> 
> -- 
> - Jeff
> 
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives