<<< Date Index >>>     <<< Thread Index >>>

Re: recursive DNS servers DDoS as a growing DDoS problem



Geo. wrote:
The flood is a flood of answers not queries, you spoof the source address of
a query with the address of your target, the target gets the response from
the dns server. A cache on the dns server just makes it a more efficient
response.

Queries are bad enough. This can be played with from any point in the chain. I.e. from the amount of querying clients, the number of so-called "relaying servers", possible /effective/ amplification and the size of the TXT SOA record.

Increase any of these and you somewhat increase the attack if one of the others is controlled. So treating just one is not really a solution.

We provided with an equation of sort to this effect in the paper we pre-released for the community when the FUD started (was supposed to eventually be an academic paper):
http://www.isotf.org/news/DNS-Amplification-Attacks.pdf

Yes, in my opinion recursion should be put under better control, but it's what-a-mole all over again if we do it by running after servers. The problem here (if we are to ignore just for a moment other UDP/DNS attacks) is with the attack vector - spoofing.

Many networks today allow spoofing.

Should recursion by default be disabled? Yes. Is it a problem when done insecurely? Yes. Is it what we should run after on the "client-side" servers? No, or maybe not Yes but not Only.

I have not seen a perfect solution yet, at best the solutions I've seen
mentioned eliminate this one flood vector. I would suggest that when
considering which one to choose we look at what we lose with each choice.
Eliminate spoofing and you lose virtually nothing, eliminate open recursive

I am with you so far. Spoofing is not the only problem of the Internet by far, but is is a problem mostly ignored thus far as it was not actively exploited *sniff*

servers and you have just created a really powerful control mechanism for
entities to control large sections of the internet since folks from those
sections won't be able to use anyone else's DNS servers or even run their
own (much like port 25 blocking limits who can run a mail server today). He
who controls dns controls the network.

Is this like when you brought up Government conspiracies in this regard on another list?

I can understand discussion going on with different lists, I sin with that myself recently. There were no direct lists to handle DNS or botnets issues until not long ago, still - should we just skip a list whenever you are disagreed with?

        Gadi.