Bugtraq mailing list archives
RE: recursive DNS servers DDoS as a growing DDoS problem
From: Måns Nilsson <mansaxel () sunet se>
Date: Mon, 03 Apr 2006 07:05:57 +0200
--On den 30 mars 2006 16.08.51 -0500 "Geo." <geoincidents () nls net> wrote:
Don't you think creating a control point like that is dangerous? Especially dangerous when it's DNS which runs virtually every function on the internet?
The control point is there already, as has been demonstrated by several attacks on DNS data. If we were to ignore the problem of open recursive servers, there would be a rush to implement draconian, ineffective countermeasures like packet filters. It would be a very bad thing, just like the stupid port 25 blocks are. That must be avoided and the end-to-end capability of the Internet must be preserved. (I think we are in agreement here.)
It's not a conspiracy theory, it's fact, if you create a control like that someone is going to want to control it. I suggest only that we consider this along with everything else.
If you have these concerns, I suggest you work with the available, standardised, implemented methods of verifying that DNS data is correct (ie. DNSSEC and TSIG for various parts of the infrastructure.) instead of pushing your head down in the sand even further believing TCP or open access to the rest of the net would make some difference in credibility for DNS messages. At least one TLD (se) has DNSSEC in production, large amounts of european IP address space have it, courtesy of RIPE. -- Måns Nilsson Systems Specialist +46 70 681 7204 cell KTHNOC +46 8 790 6518 office MN1334-RIPE Inside, I'm already SOBBING!
Attachment:
_bin
Description:
Current thread:
- Re: recursive DNS servers DDoS as a growing DDoS problem, (continued)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Tim (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Tim (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 03)
- Re: recursive DNS servers DDoS as a growing DDoS problem Ross Wheeler (Apr 09)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Apr 09)
- RE: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 04)
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Apr 09)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Apr 09)