Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attack on DNS root servers

root-servers.org

Post reply on HN
Print view View original

51–60 of 97 posts

Re: Attack on DNS root servers

#51

Post by majke »

llasram wrote: post #50
majke wrote: post #46

Earlier quoted context omitted.

Nope. The open recursive DNS servers, are real DNS servers, with caching and backoff logic. If, say, there are 94k [1] open DNS resolvers in the wild, each will ask you one DNS question for example.com, cache the answer and that's it. The big volume for the "fixed domain" queries indicates proper BCP-38 spoofing. [1] http://public-dns.tk/

Unless the attacker controlled the domain TTL, maybe? But good point -- I was thinking of a similar attack using random domains.

Open recursors asking for random subdomains can generate bigger volume of attack, but still, they are smart and will fall back if the server is overwhelmed.

Even if you're assuming 100 qps from each of the 94k recursors, that's only 9.4M qps. And most of the recursors will notice lack of answer and will slow down / stop the queries. In practice random subdomain attacks rarely generate more than a million qps (YMMV, there are exceptions, technical nitpics, etc).

Re: Attack on DNS root servers

#52

Post by laumars »

macns wrote: post #37
peterwwillis wrote: post #30

Earlier quoted context omitted.

.....Why would it be?

to protect a visitor's privacy

What privacy? Your IP and the hostname of the website you're connecting to isn't encrypted over HTTPS anyway. The content isn't sensitive and there's no cookies on the site. The only remotely personal data would be your accept language header (which could be guessed from your IP) and user agent string (which you can just spoof anyway if you're really that paranoid).

The MITM argument has more merit, but even there I can't see it making much difference here given it's niche appeal. Plus given it's tech-savy bias, most people will be running a reasonably hardened system (latest patches, et al) anyway. Not the best argument against running TLS I'd admit; but still a point worth raising since the only argument for running HTTPS is to prevent malware injection.

Obviously in an ideal world everything would be served under TLS. But let's be pragmatic about which sites we bully into switching.

Re: Attack on DNS root servers

#54

Post by Abundnce10 »

JoshTriplett wrote: post #40
Abundnce10 wrote: post #27

Earlier quoted context omitted.

Do you have any links to resources on Botnets. It's an interesting topic that I know very little about (e.g. How they work, how they come into existence, how they're controlled/monitored, etc). It sounds like you know a decent amount about them.

Book by one of my former professors: http://www.amazon.com/Botnets-The-Killer-Web-App/dp/15974913...

Awesome, thanks!

Re: Attack on DNS root servers

#56

Post by effie »

profmonocle wrote: post #22
paulmd wrote: post #17

Earlier quoted context omitted.

Most, but not all, DNS root name server letters received this query load. Why would you want to take down every DNS server though? That's not a very effective tactic due to caching, and what's the motive?

Possibly testing or demonstrating a botnet. I doubt the goal was to actually bring down the DNS root servers. That's been tried before and it's never even made a blip - the system is massively over-provisioned, for good reason.

I wonder, what kind of machines are those? How many of those are currently operating, and where?

Re: Attack on DNS root servers

#57

Post by robryk »

effie wrote: post #56
profmonocle wrote: post #22

Earlier quoted context omitted.

Possibly testing or demonstrating a botnet. I doubt the goal was to actually bring down the DNS root servers. That's been tried before and it's never even made a blip - the system is massively over-provisioned, for good reason.

I wonder, what kind of machines are those? How many of those are currently operating, and where?

Every (almost every?) letter is operated by a different organization, so I'd expect the setups to be different.

Re: Attack on DNS root servers

#60

Post by Corrado »

effie wrote: post #56
profmonocle wrote: post #22

Earlier quoted context omitted.

Possibly testing or demonstrating a botnet. I doubt the goal was to actually bring down the DNS root servers. That's been tried before and it's never even made a blip - the system is massively over-provisioned, for good reason.

I wonder, what kind of machines are those? How many of those are currently operating, and where?

http://www.root-servers.org/ has the answers you seek. There are currently 13 root servers operated by 12 different entities (Verizon, NASAN, RIPE, ICANN, etc.) and most locations have multiple sites (physical instances).
Post reply on HN