Attack on DNS root servers

http://root-servers.org/news/events-of-20151130.txt

by sajal83 • 11 years ago

182 90 11 years ago

root-servers.org

ck2• 11 years ago

China testing something new? Or maybe some scriptkiddie testing their new botnet?

KG8• 11 years ago

Why China of all of the 193 countries? What about Russia? US? Brazil? England?

mahouse• 11 years ago

Because it's always China, maybe?

bdamm• 11 years ago

We've always been at war with Eastasia.

Ayaz2• 11 years ago

In the limited logs I've seen so far, I've seen IPs from both China and Russia.

bluedino• 11 years ago

So what were the domain names queried?

ajhurliman2• 11 years ago

Rooftops?

882542F3884314B• 11 years ago

Root Server Operators = rootops

ajhurliman2• 11 years ago

Ah, I see. Thanks :)

cft4• 11 years ago

"Source Address Validation and BCP-38." ISPs should validate the source address of UDP traffic from their end customers. This would end most UDP based volumetric DDoS attacks.

sp3323• 11 years ago

It would help reflection attacks that direct e.g. DNS responses to the target. It wouldn't help when the DNS servers themselves are the target.

cft4• 11 years ago

The OP says that IP addresses were "randomly distributed" over IPv4 space. That's very unlikely for non-spoofed botnet addresses.

haldean• 11 years ago

It would make filtering out malicious requests easier, which would improve performance for people whose machines weren't botnetted.

codexon• 11 years ago

No it would help because instead of giving up on tracing the attacks since the source address was spoofed, you would know who was spamming packets and get them black holed.

lucb1e2• 11 years ago

What made this unique now? Was it simply a high load?

finnn• 11 years ago

Towards the bottom of the extremely short article/message:

  3.  Analysis

   This event was notable for the fact that source addresses were widely
   and evenly distributed, while the query name was not.  This incident,
   therefore, is different from typical DNS amplification attacks
   whereby DNS name servers (including the DNS root name servers) have
   been used as reflection points to overwhelm some third party.

   The DNS root name server system functioned as designed, demonstrating
   overall robustness in the face of large-scale traffic floods observed
   at numerous DNS root name servers.

   Due to the fact that IP source addresses can be easily spoofed, and
   because event traffic landed at large numbers of anycast sites, it is
   unrealistic to trace the incident traffic back to its source.

   Source Address Validation and BCP-38 should be used wherever possible
   to reduce the ability to abuse networks to transmit spoofed source
   packets.

lucb1e2• 11 years ago

was notable for [random source addresses]

I thought that was a common thing to do if it's not reflected. Flooding the pipe is older rather than newer.

Thanks for clarifying though!

paulmd2• 11 years ago

Typically what you see are "amplification attacks". That's where Alice wants to DOS Bob, so she spoofs a request to Charlie that appears to come from Bob. This results in a message from Charlie to Bob. The message from A->C is crafted such that it results in a much larger return message from C->B (hence "amplification"). That lets you create an attack that produces a multiple of the bandwidth that you actually control. Then you have a bunch of machine spam the message.

In that case, you see many messages from the same source address (meaning the target under attack, i.e. Bob), but the data requested may vary. In this case, the source addresses were uncorrelated, but they all wanted the exact same address, so basically the opposite.

I can't say that I know what it is, but when you see massive spikes like that it's usually a botnet of some kind (whether it's infected machines, injected connections, or whatever method). Perhaps a bunch of bots resolving their next C&C master?

Abundnce102• 11 years ago

Do you have any links to resources on Botnets. It's an interesting topic that I know very little about (e.g. How they work, how they come into existence, how they're controlled/monitored, etc). It sounds like you know a decent amount about them.

gcommer2• 11 years ago

The root servers get large traffic spikes quite routinely, this event was simply an order of magnitude or more larger than any previous events (AFAIK). Also, it actually managed to DoS a few instances, by way of saturating their throughput--though as the notice mentions, the overall DNS wasn't significantly affected aside from a few queries having to be retried.

Corrado2• 11 years ago

You can clearly see the spike in this graph[0] (scale it down to Dec to see more detail). These graphs[1] show that it was limited to IPv4.

[0] http://a.root-servers.org/metrics.html

[1] http://k.root-servers.org/statistics/ROOT/monthly/

robryk2• 11 years ago

I suspect that this might have been a botnet showing off to its potential clients. This may explain withholding of the domain names queried (not to give advertising to the botnet).

comboy2• 11 years ago

Well I'm pretty impressed.

    observed traffic volume due to this event was up to approximately 5
    million queries per second, per DNS root name server letter receiving
    the traffic.

i.e. over 50 million queries per second distributed evenly across IPv4

johansch2• 11 years ago

It was presumably done over UDP where it's trivial to fake source IP. What's the minimum size of a valid UDP-based DNS request? Let's guesstimate 25 bytes. Then 50M/s * 25 bytes = 1.25 GB/s. Or 10 Gbit/s.

Is that really so impressive these days?

Goopplesoft• 11 years ago

Why is root-servers.org not https?

peterwwillis5• 11 years ago

.....Why would it be?

macns3• 11 years ago

to protect a visitor's privacy

bpicolo2• 11 years ago

You transmit no secret information to it, and it none to you?

dschep• 11 years ago

But how do I know the information it sends to me hasn't been MITM'd if it isn't SSL'd?

x1798DE• 11 years ago

And you don't mind if the traffic is intercepted and modified?

navadavuluri• 11 years ago

Is there significance to NTP requests in relationship to DDOS?

tptacek• 11 years ago

Yes; NTP is an amplification vector, which means you can spoof a small NTP request and generate a large NTP response aimed at your target.

mb0• 11 years ago

Yes. Both NTP and DNS operate over UDP. UDP is a connectionless protocol, which means no connection handshake needs to be made in order for a data to be delivered to a target IP address. What generally happens is, one attacker will send many requests to a many DNS and or NTP servers whilst spoofing their IP address to make it appear as if their victim is sending all of these requests. No connection handshake happens to verify that the victim is actually making these requests. So, every server that the attacker sent this request to will send the much-larger answer back to the victim. If DNS were to only operate over TCP (which uses a connection handshake), the internet would be much slower, because connection handshakes can take a while.

However, this isn't what happened on Monday. It seems like one attacker with a lot of systems used those systems to query someone's domain name whilst spoofing many IP addresses at once. This in turn overwhelmed many of the root servers, and possibly several authoritive DNS servers in the process. Sounds like a botnet owner was showing off how much power they have.

llasram2• 11 years ago

I bet the observed "random" source addresses are open recursive DNS servers. For this kind of attack they provide essentially free traffic-washing for whatever actual traffic-generation mechanism the attackers have.

majke2• 11 years ago

Nope.

The open recursive DNS servers, are real DNS servers, with caching and backoff logic. If, say, there are 94k [1] open DNS resolvers in the wild, each will ask you one DNS question for example.com, cache the answer and that's it.

The big volume for the "fixed domain" queries indicates proper BCP-38 spoofing.

[1] http://public-dns.tk/

llasram2• 11 years ago

Unless the attacker controlled the domain TTL, maybe? But good point -- I was thinking of a similar attack using random domains.

theanomaly• 11 years ago

The trick is to request random top-level domains, where each request will necessarily trigger a lookup to the root.

Further, recent research has shown the number of open DNS resolvers to be in the range of 15-30 million[1].

Since the article describes a single domain name was used in the attack however, that's not what happened here.

[1] http://icir.net/mallman/papers/dns-probe-meth-imc13.pdf

SixSigma• 11 years ago

related ?

Day 2: UK research network Janet still being slapped by DDoS attack DNS services appear to be targeted, switching may work

http://www.theregister.co.uk/2015/12/08/uk_research_network_...

chei0aiV• 11 years ago

what was the query string?

rmdoss• 11 years ago

The beauty of DNS: No one was affected or noticed the problem. Resolvers just tried another one if they didnt get a response from one of the root servers.

paulddraper• 11 years ago

DNS would be a disaster if taken down. It's also impossible.

gawi• 11 years ago

Donald Trump's failed attempt to shut down the Internet.

Ayaz2• 11 years ago

They don't mention otherwise but do we know if the attack has happened again since 1 December?

Attack on DNS root servers

Related Stories