Forgot your password?
typodupeerror
Networking Security Technology

Misconfigured Open DNS Resolvers Key To Massive DDoS Attacks 179

Posted by Unknown Lamer
from the check-your-sources dept.
msm1267 writes with an excerpt From Threat Post: "While the big traffic numbers and the spat between Spamhaus and illicit webhost Cyberbunker are grabbing big headlines, the underlying and percolating issue at play here has to do with the open DNS resolvers being used to DDoS the spam-fighters from Switzerland. Open resolvers do not authenticate a packet-sender's IP address before a DNS reply is sent back. Therefore, an attacker that is able to spoof a victim's IP address can have a DNS request bombard the victim with a 100-to-1 ratio of traffic coming back to them versus what was requested. DNS amplification attacks such as these have been used lately by hacktivists, extortionists and blacklisted webhosts to great success." Running an open DNS resolver isn't itself always a problem, but it looks like people are enabling neither source address verification nor rate limiting.
This discussion has been archived. No new comments can be posted.

Misconfigured Open DNS Resolvers Key To Massive DDoS Attacks

Comments Filter:
  • Article is garbage (Score:5, Insightful)

    by Anonymous Coward on Thursday March 28, 2013 @04:40PM (#43306559)

    It claims that the problem is DNS resolvers that don't authenticate the sender's IP address using BCP38 [ietf.org]. It is comparing chalk and cheese. Filtering out spoofed IP addresses is something that needs to happen at the edge of the network. It's not something that a single server on the network can do.

  • by Anonymous Coward on Thursday March 28, 2013 @04:52PM (#43306661)

    Isn't the real problem the originating ISPs for allowing spoofed packets to be sent in the first place? Is it really correct to be blaming the DNS resolver that it's responding to packets it has no way to authenticate? If the original ISP dropped a packet it shouldn't be routing, the whole problem would go awa.

  • Re:By Design (Score:3, Insightful)

    by LordLimecat (1103839) on Thursday March 28, 2013 @06:04PM (#43307221)

    Can someone explain how a DNS server can check source address validity? Is it going to fire off more packets to that source address (worsening the DDoS) or what?

"Who cares if it doesn't do anything? It was made with our new Triple-Iso-Bifurcated-Krypton-Gate-MOS process ..."

Working...