Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attack on DNS root servers

root-servers.org

Post reply on HN
Print view View original

21–30 of 97 posts

Re: Attack on DNS root servers

#21

Post by Dylan16807 »

cft wrote: post #19
sp332 wrote: post #18

Earlier quoted context omitted.

It would help reflection attacks that direct e.g. DNS responses to the target. It wouldn't help when the DNS servers themselves are the target.

The OP says that IP addresses were "randomly distributed" over IPv4 space. That's very unlikely for non-spoofed botnet addresses.

The botnet would still be able to perform an attack of the same size. And with many validation schemes it would still be able to randomize the last octet or two, avoiding direct identification of compromised computers.

Re: Attack on DNS root servers

#22

Post by profmonocle »

paulmd wrote: post #17
lucb1e wrote: post #15

Earlier quoted context omitted.

> was notable for [random source addresses] I thought that was a common thing to do if it's not reflected. Flooding the pipe is older rather than newer. Thanks for clarifying though!

Most, but not all, DNS root name server letters received this query load. Why would you want to take down every DNS server though? That's not a very effective tactic due to caching, and what's the motive?

Possibly testing or demonstrating a botnet. I doubt the goal was to actually bring down the DNS root servers. That's been tried before and it's never even made a blip - the system is massively over-provisioned, for good reason.

Re: Attack on DNS root servers

#23

Post by [deleted] »

comboy wrote: post #16
robryk wrote: post #9

I suspect that this might have been a botnet showing off to its potential clients. This may explain withholding of the domain names queried (not to give advertising to the botnet).

Well I'm pretty impressed. observed traffic volume due to this event was up to approximately 5 million queries per second, per DNS root name server letter receiving the traffic. i.e. over 50 million queries per second distributed evenly across IPv4

[deleted]

Re: Attack on DNS root servers

#25

Post by johansch »

comboy wrote: post #16
robryk wrote: post #9

I suspect that this might have been a botnet showing off to its potential clients. This may explain withholding of the domain names queried (not to give advertising to the botnet).

Well I'm pretty impressed. observed traffic volume due to this event was up to approximately 5 million queries per second, per DNS root name server letter receiving the traffic. i.e. over 50 million queries per second distributed evenly across IPv4

It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s.

Is that really so impressive these days?

Re: Attack on DNS root servers

#26

Post by comboy »

johansch wrote: post #25
comboy wrote: post #16

Earlier quoted context omitted.

Well I'm pretty impressed. observed traffic volume due to this event was up to approximately 5 million queries per second, per DNS root name server letter receiving the traffic. i.e. over 50 million queries per second distributed evenly across IPv4

It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s. Is that really so impressive these days?

Is it really that trivial to fake source IP? I think pretty much any ISP wouldn't let such packets through (or am I missing something?), and you are also easier to find then (well, if you are not careful that is).

Re: Attack on DNS root servers

#27

Post by Abundnce10 »

paulmd wrote: post #12
lucb1e wrote: post #8

What made this unique now? Was it simply a high load?

Typically what you see are "amplification attacks". That's where Alice wants to DOS Bob, so she spoofs a request to Charlie that appears to come from Bob. This results in a message from Charlie to Bob. The message from A->C is crafted such that it results in a much larger return message from C->B (hence "amplification"). That lets you create an attack that produces a multiple of the bandwidth that you actually contro…

Do you have any links to resources on Botnets. It's an interesting topic that I know very little about (e.g. How they work, how they come into existence, how they're controlled/monitored, etc). It sounds like you know a decent amount about them.

Re: Attack on DNS root servers

#28

Post by [deleted] »

Dylan16807 wrote: post #21
cft wrote: post #19

Earlier quoted context omitted.

The OP says that IP addresses were "randomly distributed" over IPv4 space. That's very unlikely for non-spoofed botnet addresses.

The botnet would still be able to perform an attack of the same size. And with many validation schemes it would still be able to randomize the last octet or two, avoiding direct identification of compromised computers.

[deleted]
Post reply on HN