Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Attack on DNS root servers

root-servers.org

Post reply on HN
Print view View original

81–90 of 97 posts

Re: Attack on DNS root servers

#81

Post by theanomaly »

majke wrote: post #46
llasram wrote: post #45

I bet the observed "random" source addresses are open recursive DNS servers. For this kind of attack they provide essentially free traffic-washing for whatever actual traffic-generation mechanism the attackers have.

Nope. The open recursive DNS servers, are real DNS servers, with caching and backoff logic. If, say, there are 94k [1] open DNS resolvers in the wild, each will ask you one DNS question for example.com, cache the answer and that's it. The big volume for the "fixed domain" queries indicates proper BCP-38 spoofing. [1] http://public-dns.tk/

The trick is to request random top-level domains, where each request will necessarily trigger a lookup to the root.

Further, recent research has shown the number of open DNS resolvers to be in the range of 15-30 million[1].

Since the article describes a single domain name was used in the attack however, that's not what happened here.

[1] http://icir.net/mallman/papers/dns-probe-meth-imc13.pdf

Re: Attack on DNS root servers

#82

Post by therein »

cmdrfred wrote: post #79
dschep wrote: post #38

Earlier quoted context omitted.

But how do I know the information it sends to me hasn't been MITM'd if it isn't SSL'd?

But if you don't have DNS how do you download the revocation list?

How is a system with at least the ability to validate the origin but without repudiation worse than a system with absolutely no security at all.

Re: Attack on DNS root servers

#83

Post by ytjohn »

effie wrote: post #56
profmonocle wrote: post #22

Earlier quoted context omitted.

Possibly testing or demonstrating a botnet. I doubt the goal was to actually bring down the DNS root servers. That's been tried before and it's never even made a blip - the system is massively over-provisioned, for good reason.

I wonder, what kind of machines are those? How many of those are currently operating, and where?

When things first started, a root server might have actually been something sitting under Jon Postel's desk, or in the back room of a University.

But these days, root "servers" are geographically load balanced clusters of machines. Think of something like the Akamai CDN, but instead of http(s), this CDN serves up mostly UDP/53 and TCP/53 traffic. The IP for a root server is AnyCast, and the root server operators will balance traffic between sites by adjusting BGP.

Most have built their own custom UDP load balancers at each site and behind those load balancers are several hundred physical servers to respond to the incoming queries. Zone updates are pushed to each site from the back office, so each physical server should have a complete copy of the the "." zone.

A root server operator, operating 1 of the world's 13 largest public udp system, is often under attack, either directly or (as mentioned above), used as part of a reflector attack against someone else. Generally speaking, these systems are over provisioned enough so that a direct attack has minimal impact. But reflector attacks are the main concern. Either way, when an attack starts, the operator has to find something unique in the query itself (as eliminating source addresses in a dddos is nigh impossible), create a filtering rule, and push that to all of their load balancers.

Disclaimer: I used to work for a root server org.

Re: Attack on DNS root servers

#84

Post by Buge »

peterwwillis wrote: post #59
medecau wrote: post #41

Earlier quoted context omitted.

Or to ensure that the content is not tampered.

Nobody would tamper with this content.

China injected javascript malware into non-https traffic that joined the users into a botnet that launched a DDOS attack on Github. The "Great Cannon".

Re: Attack on DNS root servers

#87

Post by mirashii »

meowface wrote: post #78
sjbase wrote: post #74

Earlier quoted context omitted.

You're definitely asking the right question, and IMO the answer is "sortof." It's not that impressive in the grand scheme of DDoS, given major attacks will sustain 100 gigabit traffic[1] sometimes for days on end. But 20gbit/s would likely be enough to take down a small & unprepared business. [1]: http://www.techworld.com/news/security/worlds-largest-ddos-a...

20 Gbps definitely isn't very impressive given the current landscape, but it can probably take down many medium-sized businesses as well, if they have no DDoS mitigations. Even a large one, if they somehow had no mitigations or no decent security team.

20Gbps is actually still impressive if it is a set of valid requests like the parent seems to imply when doing the calculations. 20Gbps via a reflection technique is easy, but also relatively easy to filter and just requires a large pipe. 20Gbps of traffic doing legitimate requests that you can't immediately and trivially filter/rule out is still an impressive feat right now.

Re: Attack on DNS root servers

#89

Post by Ayaz »

KG8 wrote: post #4
ck2 wrote: post #2

China testing something new? Or maybe some scriptkiddie testing their new botnet?

Why China of all of the 193 countries? What about Russia? US? Brazil? England?

In the limited logs I've seen so far, I've seen IPs from both China and Russia.
Post reply on HN