Re: recursive DNS servers DDoS as a growing DDoS problem

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: Re: recursive DNS servers DDoS as a growing DDoS problem
From: Paul Stepowski <p.stepowski@xxxxxxxxxx>
Date: Fri, 31 Mar 2006 11:27:17 +1000
In-reply-to: <4428869E.2020800@xxxxxxxxxxx>
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
References: <44042E72.7010602@xxxxxxxxxxxx> <20060325094032.GS24049@xxxxxxxxxxx> <44256AA2.8010306@xxxxxxxxxxxx> <00da01c650f3$a27cca00$69fea8c0@honeypot> <4428869E.2020800@xxxxxxxxxxx>
User-agent: Mozilla Thunderbird 0.5 (X11/20040208)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stephen Samuel wrote:
| To put it another way: UDP as a purely connectionless
| protocol is fast becoming a liability in situations where
| significant amplification is possible.

My thoughts exactly.  This attack is possible because of a design limitation of
UDP (and other connectionless protocols).  I realise that DNS is receiving
attention because of it's ubiquity on the Internet, but this type of attack can
leverage any service that responds with a reply packet larger than the initial
query packet where the protocol used is connectionless.  TCP/IP is showing it's
age (again).

Thanks,

Paul
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFELIV14qOLghPAuV0RAvrVAKCZBb85yHnwB3+RAOyqvDocbUQYPwCgzSpV
1nnSrOO74gRDzoZSnNxd2jI=
=Rl7W
-----END PGP SIGNATURE-----

References:
- recursive DNS servers DDoS as a growing DDoS problem
  - From: Gadi Evron
- Re: recursive DNS servers DDoS as a growing DDoS problem
  - From: MaddHatter
- Re: recursive DNS servers DDoS as a growing DDoS problem
  - From: Gadi Evron
- Re: recursive DNS servers DDoS as a growing DDoS problem
  - From: Geo.
- Re: recursive DNS servers DDoS as a growing DDoS problem
  - From: Stephen Samuel

Prev by Date: GeSWall 2.2 – Free Intrusion Prevention System for Windows
Next by Date: SiteMan <= All version SQL injection in admin_login.asp
Previous by thread: Re: recursive DNS servers DDoS as a growing DDoS problem
Next by thread: Re: recursive DNS servers DDoS as a growing DDoS problem
Index(es):
- Date
- Thread