Re: recursive DNS servers DDoS as a growing DDoS problem

[v9 () fakehalo us]

While you're on the subject of the potentials of DOSing using DNS servers, I noticed several months ago some possible 
abuses myself, although I soon lost interest for some reason or another.

I noticed that a portion of the worlds DNS servers for some reason or another send back large amounts of duplicate 
replies if, and only if, the domain being resolved does not exist.

The amount of duplicates seems to range between 2 and 24(in steps of 2, 4, 8, 12, 16, 20 and 24), where each reply 
packet is roughly 2.5x(including IP header) larger than the original request(because of the SOA).  So, for example one 
request to a DNS server that sends 24 dups back would roughly equal 60x(24*2.5) amplification of data.

an example of a random server I found while scanning(12 dups from one request):
-------------------------------------------------term1# host x 68.1.2.3

...

term2# /usr/sbin/tcpdump -n src 68.1.2.3
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 68 bytes
00:04:58.459356 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:04:58.481281 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:04:58.514411 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:01.459157 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:01.478706 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:01.512249 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:04.459512 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:04.480542 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:04.512085 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:07.458823 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:07.477374 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
00:05:07.511919 IP 68.1.2.3.53 > xxx.xxx.xxx.xxx.1865:  62623 NXDomain 0/1/0 (94)
-------------------------------------------------

At the time I noticed this I decided to create a scanner to find out how many DNS servers are susceptible to this, I 
found no shortage.  I ran it only for a few hours starting at 68.0.0.1 and found hundreds of DNS servers that sent back 
dup replies(mostly 12 and 8 dups).

I also created a DOS tool to test the theory at the time, but I see no reason to post that.

I still don't know the cause of this, just figured I would attach it on this subject for someone to decypher.

For anyone interested in the scanner, which is light on documentation:

http://fakehalo.us/dnsdbd-gp.c
http://fakehalo.us/dnsdbd.c

(the -gp.c version simply stores the ip of the dns server in character form so its easier to read by human eyes)