Bugtraq mailing list archives
Re: recursive DNS servers DDoS as a growing DDoS problem
From: "Geo." <geoincidents () nls net>
Date: Sun, 26 Mar 2006 11:34:53 -0500
Spoofing is indeed the attack vector and it can also be utilized for NTP, ICMP, etc. It is to blame. Still, DNS is what's being exploited and in my opinion a broken feature being exploited needs fixing, or it will be exploited.
What feature of DNS is being exploited, UDP or the fact that there are a lot of dns servers you can use? If you have a 20,000 bot botnet and each bot has 2 defined recursive dns servers that it is allowed to use and these bots are on the local subnet (ie BCP38 is implimented at the gateway but not at every router) then how exactly is locking down recursive servers so you can only use yours going to solve anything? To fix DNS we would have to eliminate it's use of UDP which means pretty much all internet software would need to be rewritten, that is an unrealistic goal. Locking down recursive servers may increase the number of machines required to create a flood but again a large botnet will have no problem so that's no solution either. BCP38 will accomplish the same ineffective goal but at least has the added potential to reduce non DNS related spoofed attacks at the same time making it easier to at least track down the sources of a distributed flood at least to the provider level if not to the exact IP. Geo.
Current thread:
- Re: recursive DNS servers DDoS as a growing DDoS problem v9 (Mar 01)
- Message not available
- <Possible follow-ups>
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Mar 02)
- Re: recursive DNS servers DDoS as a growing DDoS problem Ventsislav Genchev (Mar 10)
- Re: recursive DNS servers DDoS as a growing DDoS problem Robert Story (Mar 17)
- Re: recursive DNS servers DDoS as a growing DDoS problem Michael Sierchio (Mar 20)
- Re: recursive DNS servers DDoS as a growing DDoS problem Robert Story (Mar 17)
- Re: recursive DNS servers DDoS as a growing DDoS problem Chris Thompson (Mar 23)
- Re: recursive DNS servers DDoS as a growing DDoS problem Anton Ivanov (Mar 27)
- Re: recursive DNS servers DDoS as a growing DDoS problem MaddHatter (Mar 25)
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Mar 25)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Mar 27)
- Re: recursive DNS servers DDoS as a growing DDoS problem mike davis (Mar 30)
- Re: recursive DNS servers DDoS as a growing DDoS problem Geo. (Mar 30)
- Re: recursive DNS servers DDoS as a growing DDoS problem gboyce (Mar 30)
- Re: recursive DNS servers DDoS as a growing DDoS problem Stephen Samuel (Mar 30)
- Re: recursive DNS servers DDoS as a growing DDoS problem Gadi Evron (Mar 25)