Re: DDos Attack To Drop The Internet

[James Hodgkinson <yaleman () ricetek net>]

Given enough bandwidth and a unique idea, anything is possible, it is
true. 

You provided a 2MB text list of DNS servers, approximately 200,000 of
them. They sit across most of the v4 IP ranges available (and some IPV6
ones). This means upstream links won't likely be saturated, and
filtering can likely be done on the server based on heuristics.

If you're going to ask for 100% random non-existent domains you're easy
to beat - if( failed_request() > 99% ) { drop_packet() }. If you're
going to ask for TLDs that exist, they're already cached by anyone
running a half-decent server, and they're going to send you elsewhere.
You might cause issues for individual downstream ranges as people get
heavy-handed with filtering, but you've included google's servers in
there and I'm guessing the roots are there too. They're anycast and
backed by some crazy bandwidth.

Of course it might work once, for a short time, but you've just told
some spectacular engineers out there to think about this problem, and
they've definitely already considered it ;) 

James

On Tue, 6 Oct 2015, at 01:39, Jeffrey Roberts wrote:
> If you were to have a botnet which were to flood random DNS queries
> for domains that did not exist to the list of DNS servers hosted on
> http://public-dns.tk/nameservers-all.txt then the root dns servers and
> the tld dns servers would be overwhelmed without any way to filter the
> packets, if they were to filter the packets of the DNS servers, they
> themselves would be turning off DNS, hence they can not do that... If
> the botnet only hits the DNS servers on the list a few times,
> filtering those packets would be insignificant. This attack should in
> essence turn off DNS for the world, hence, turning off the internet as
> the public knows it today.
>
> -- 
> - Jeff
>
> _______________________________________________
> Sent through the Full Disclosure mailing list
> https://nmap.org/mailman/listinfo/fulldisclosure
> Web Archives & RSS: http://seclists.org/fulldisclosure/

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/