mailing list archives
Re: Tightened DNS security question re: DNS amplification attacks.
From: David Andersen <dga () cs cmu edu>
Date: Tue, 27 Jan 2009 22:46:35 -0500
On Jan 27, 2009, at 10:21 PM, Paul Vixie wrote:
(looking for ". IN NS" as the q-tuple pattern is not a solution,
bad guys can pretty trivially change the question they ask into one
willing to answer.)
Actually, ". IN NS" is a particularly useful thing for them to do,
because it's an almost globally guaranteed response that will get a
large response and be in cache. One can get similar effects with
"<tld>. IN NS", of course, but the set of things that work well for
such an attack are relatively limited.
One thing that's fairly straightforward with the current attack is to
00600 deny udp from 126.96.36.199 to me 53 iplen 45
(foreach victim host)
(If you tcpdump the traffic, because of the . IN NS, the packets are
all the same length - 45 IP bytes.) Very easy to filter at the
current time with almost no collateral damage.
I realize this is just a cat-and-mouse game, but forcing the attacker
to use larger query packets that have smaller cached replies isn't a
". NS" -> 45 byte query, 245 byte response
"COM. NS" -> 48 byte query, 245 byte response
"NET. NS" -> 242 byte response,
"ORG. NS" -> 159 byte response,
This masking is mostly effective for people whose nameservers are set
to deny recursive but are still serving from cache. YMMV.
Description: This is a digitally signed message part