Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: DNS bind attacks
From: Chris Granger <chrisgrangerx () gmail com>
Date: Thu, 26 Jan 2012 13:17:21 -0500

Your theory's likely correct - do you allow external IPs to make recursive queries to your server? 

From (this would be a way to corroborate & I can't say it any better): 
http://www.gossamer-threads.com/lists/nanog/users/143319

"The isc.org record is commonly used in reflection attacks because the size of the record is so large, so the 
amplification factor is greatly increased. Can you check to see if +edns=0 was set in the query? That would be a sure 
sign this is related... "

Sent from my iPhone

On Jan 26, 2012, at 6:35 AM, "J. von Balzac" <jhm.balzac () gmail com> wrote:

I'm seeing a lot of hosts in my named logs (I mean log files, it's not
like I am naming my poop)

...ok... silly joke hehe

So anyway, named bind is reporting a lot of denied queries of type
'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which
is to immediately block the IPs for port 53 after as few as one denied
query) - but I want to warn server admins who haven't spotted both
these queries and other denied queries.

Common sense suggests that these hosts are probably spoofed IPs. Looks
like an effective way to ddos a host: request an arbitrary DNS record
with a spoofed IP and let the server reply to the spoofed IP in
whatever way. Do that with many hosts and there is your denial of
service.

A side effect is that when you block the IP, you're blocking something
that isn't really doing anything wrong as it's a spoofed IP

But ok, I'm not too sure of this so please shoot holes in my theory or
suggest better fixes/workarounds/...

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]