Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attack on DNS root servers

root-servers.org

Post reply on HN
Print view View original

11–20 of 97 posts

Re: Attack on DNS root servers

#11

Post by finnn »

lucb1e wrote: post #8

What made this unique now? Was it simply a high load?

Towards the bottom of the extremely short article/message:

  3.  Analysis

   This event was notable for the fact that source addresses were widely
   and evenly distributed, while the query name was not.  This incident,
   therefore, is different from typical DNS amplification attacks
   whereby DNS name servers (including the DNS root name servers) have
   been used as reflection points to overwhelm some third party.

   The DNS root name server system functioned as designed, demonstrating
   overall robustness in the face of large-scale traffic floods observed
   at numerous DNS root name servers.

   Due to the fact that IP source addresses can be easily spoofed, and
   because event traffic landed at large numbers of anycast sites, it is
   unrealistic to trace the incident traffic back to its source.

   Source Address Validation and BCP-38 should be used wherever possible
   to reduce the ability to abuse networks to transmit spoofed source
   packets.

Re: Attack on DNS root servers

#12

Post by paulmd »

lucb1e wrote: post #8

What made this unique now? Was it simply a high load?

Typically what you see are "amplification attacks". That's where Alice wants to DOS Bob, so she spoofs a request to Charlie that appears to come from Bob. This results in a message from Charlie to Bob. The message from A->C is crafted such that it results in a much larger return message from C->B (hence "amplification"). That lets you create an attack that produces a multiple of the bandwidth that you actually control. Then you have a bunch of machine spam the message.

In that case, you see many messages from the same source address (meaning the target under attack, i.e. Bob), but the data requested may vary. In this case, the source addresses were uncorrelated, but they all wanted the exact same address, so basically the opposite.

I can't say that I know what it is, but when you see massive spikes like that it's usually a botnet of some kind (whether it's infected machines, injected connections, or whatever method). Perhaps a bunch of bots resolving their next C&C master?

Re: Attack on DNS root servers

#15

Post by lucb1e »

finnn wrote: post #11
lucb1e wrote: post #8

What made this unique now? Was it simply a high load?

Towards the bottom of the extremely short article/message: 3. Analysis This event was notable for the fact that source addresses were widely and evenly distributed, while the query name was not. This incident, therefore, is different from typical DNS amplification attacks whereby DNS name servers (including the DNS root name servers) have been used as reflection points to overwhelm some third party. The DNS root name…

> was notable for [random source addresses]

I thought that was a common thing to do if it's not reflected. Flooding the pipe is older rather than newer.

Thanks for clarifying though!

Re: Attack on DNS root servers

#16

Post by comboy »

robryk wrote: post #9

I suspect that this might have been a botnet showing off to its potential clients. This may explain withholding of the domain names queried (not to give advertising to the botnet).

Well I'm pretty impressed.

    observed traffic volume due to this event was up to approximately 5
    million queries per second, per DNS root name server letter receiving
    the traffic.
i.e. over 50 million queries per second distributed evenly across IPv4

Re: Attack on DNS root servers

#17

Post by paulmd »

lucb1e wrote: post #15
finnn wrote: post #11

Earlier quoted context omitted.

Towards the bottom of the extremely short article/message: 3. Analysis This event was notable for the fact that source addresses were widely and evenly distributed, while the query name was not. This incident, therefore, is different from typical DNS amplification attacks whereby DNS name servers (including the DNS root name servers) have been used as reflection points to overwhelm some third party. The DNS root name…

> was notable for [random source addresses] I thought that was a common thing to do if it's not reflected. Flooding the pipe is older rather than newer. Thanks for clarifying though!

   Most, but not all, DNS root name server letters received this query load.
Why would you want to take down every DNS server though? That's not a very effective tactic due to caching, and what's the motive?

Re: Attack on DNS root servers

#18

Post by sp332 »

cft wrote: post #7

"Source Address Validation and BCP-38." ISPs should validate the source address of UDP traffic from their end customers. This would end most UDP based volumetric DDoS attacks.

It would help reflection attacks that direct e.g. DNS responses to the target. It wouldn't help when the DNS servers themselves are the target.

Re: Attack on DNS root servers

#19

Post by cft »

sp332 wrote: post #18
cft wrote: post #7

"Source Address Validation and BCP-38." ISPs should validate the source address of UDP traffic from their end customers. This would end most UDP based volumetric DDoS attacks.

It would help reflection attacks that direct e.g. DNS responses to the target. It wouldn't help when the DNS servers themselves are the target.

The OP says that IP addresses were "randomly distributed" over IPv4 space. That's very unlikely for non-spoofed botnet addresses.

Re: Attack on DNS root servers

#20

Post by sp332 »

cft wrote: post #19
sp332 wrote: post #18

Earlier quoted context omitted.

It would help reflection attacks that direct e.g. DNS responses to the target. It wouldn't help when the DNS servers themselves are the target.

The OP says that IP addresses were "randomly distributed" over IPv4 space. That's very unlikely for non-spoofed botnet addresses.

Yes, but for a volumetric attack, it doesn't matter if you know the source IPs. It just fills your pipes until legitimate traffic can't get through. (This wasn't a volumetric attack though, which is why it would have helped.)
Post reply on HN