IT Pro confession: I contributed to the DDOS attack against Spamhaus

http://www.theregister.co.uk/2013/03/28/i_accidentally_the_internet/

by esalazar • 13 years ago

79 52 13 years ago

theregister.co.uk

sciurus• 13 years ago

"""Let's say that you leave your recursive server open to the internet. Now not only can you ask your DNS server for information about other DNS servers on the internet, so can anyone else. If someone asks your server "where is www.google.com" a whole bunch of times then your server starts flooding google.com's DNS servers. For every 1 byte of data sent to your DNS server 50 bytes of traffic end up directed at the target."""

This explanation is skipping a key component of a DNS reflection attack. When the attacker makes a DNS request, they spoof their source address so it is the address of the host they want to attack. Thus they send a small request to your DNS server, and your DNS server returns a large response not to them, but to the host they're attacking.

laumars2• 13 years ago

I think that was implied. However you're right that the author should have made that a little more clear.

bradleyjg2• 13 years ago

Why does it need to be recursive then?

Couldn't you perform the same attack by querying a whole bunch of authoritative name servers for zones they serve with forged source addresses?

entropy_3• 13 years ago

The attack as specified by the article would be pretty ineffective as recursive DNS servers tend to have a cache. So only the first request would hit the target DNS server.

Also, you can definitely do this with authoritative servers only, which is why only egress filtering by ISPs is a permanent solution to the problem. However, there are way fewer authoritative DNS servers out there than there are open recursors and they are better managed. So an attack would never grow to the scale this one has grown to using only authoritative servers.

Anderkent• 13 years ago

You'd have to ask for different domain names for every DNS server, while when they're recursive you can ask every machine for the same name, one chosen for particularly large result.

dsl3• 13 years ago

You should also note that DNSSEC is just as much of a problem as open resolvers.

A normal A record lookup results in 1-2x amplification

   $ dig www.ripe.net. in a | grep SIZE
   ;; MSG SIZE  rcvd: 46

Asking for DNSSEC records specifically yields a 10x+ amplification

   $ dig www.ripe.net. in RRSIG | grep SIZE
   ;; MSG SIZE  rcvd: 534

According to research by DJB[1] over 2000 DNSSEC enabled zones provide >30x amplification for incoming UDP queries.

1. cr.yp.to/talks/2012.06.04/slides.pdf

lambda• 13 years ago

But you can easily force regular DNS to give you high amplification. Just query a domain which gives you a larger response, such as multiple A records, MXes, SPF records, and so on. For example:

    $ dig google.com. ANY | grep SIZE
    ;; MSG SIZE  rcvd: 546

If you want more amplification than that gives, just host one yourself. The recursive resolver will hit your DNS server once, then send out replies based on the cache.

There seems to be lots of fearmongering about DNSSEC amplification, but you can get just the same amount of amplification out of regular DNS, so it seems that fixing DNS amplification in other ways would be more effective than trying to avoid adopting DNSSEC.

matt_heimer• 13 years ago

Thanks, I was wondering about their explanation. Every DNS server I setup will temporary cache the results of its recursive lookups so I didn't get how this was going to work.

laumars2• 13 years ago

I have a couple of name servers I've inherited since starting my job. How would I go about testing these servers to see if they're set up correctly (obviously I'm not interested in the forged UDP packets side of things, only testing to make sure that recursive look ups are disabled).

jethro_tell• 13 years ago

you could do an nslookup google.com <your.name.server.ip> from off network, or check your blocks on http://openresolverproject.org/

mindstab2• 13 years ago

Whats a simple way to confirm by test your DNS server isn't doing recursion?

rhizome• 13 years ago

A little Googling can often help:

http://dnsknowledge.com/bind/howto-test-bind-open-recursive-...

mindstab2• 13 years ago

fantastic, thanks!

tquai• 13 years ago

The Open DNS Resolver Project has a list of 25 million open resolvers. You can query their database for your IP address or up to a /24. Their site also has information on how to reduce or eliminate the problem via a couple options (RRL, BCP38). If you run a BIND resolver, consider switching to unbound. Part of this problem is rooted in BIND combining resolver and authoritative service in one daemon, which IMO "mis-educated" a lot of people.

http://openresolverproject.org/

SageRaven3• 13 years ago

How disappointing. I thought it was going to be the story of a fed-up email admin breaking down and DoS'ing one of the scourges of the internet.

Blacklists are pure evil, and nothing will ever change my opinion of that. They cause far more problems than they solve. Granted, it's usually by idiot, over-zealous mail admins who block on merely being listed anywhere, rather than by weighted score.

jff• 13 years ago

Agreed. If I had known at the time that there was a DDoS against Spamhaus, I'd have probably joined in against the self-righteous pricks. Block my home server, will you?

freehunter2• 13 years ago

As far as I know, Spamhaus doesn't block anything. They just maintain a list of IPs they see spam-like activity coming from. The actual blocking is implemented by whoever is using Spamhaus for their blacklist. Your beef is with the admins who block everything based on a single blacklist.

dne• 13 years ago

Blacklists are the only reason e-mail is still usable.

SageRaven3• 13 years ago

I thought it was statistical filtering and crowd-sourced spam tagging (like Google's spam filter). I maintain a mail server for a client and Spam Assassin (edit: and greylisting) works well enough without blacklists enabled. Throw in a couple of extra Bayesian filters via procmail, and you're doing about as well as Google does.

sdkmvx• 13 years ago

I run a mail server with OpenBSD's spamd[1] with greylisting and it works well enough. Most spam is not sent by SMTP compliant hosts. Blacklisting makes it particularly hard to recover IPs that have ever been compromised and unfairly hurts good hosts on otherwise untrustworthy (like some home ISPs) networks.

[1] http://www.openbsd.org/spamd/

codexon• 13 years ago

I hate spam as much as anyone but blacklists have gotten out of hand.

I rented a server, and when I decided to use it for sending emails, I found out the IPs were blacklisted. I tried appealing to Microsoft and they claimed the IP was blacklisted after I rented it. This was ridiculous since I had just installed Postfix for a few days and barely sent any emails out.

So I decided to relay all my emails to another server and haven't had any problems with it for a year except now I am stuck with a server with blacklisted IPs.

Some messages still randomly get blocked by Hotmail while Gmail happily accepts them. This whole email delivery problem is a mess and the fact that people are paying to have someone else send their emails is proof of how bad Email is failing.

brokentone2• 13 years ago

The post slug is the best part of this article by far: "i_accidentally_the_internet" Full current URL in case it gets updated: http://www.theregister.co.uk/2013/03/28/i_accidentally_the_i...

alxndr2• 13 years ago

You'll like the opening image in this, then; #10 on HN home page right now: http://blog.tinfoilsecurity.com/building-a-browser-extension...

brokentone2• 13 years ago

I'm familiar with the meme. The humor isn't in the meme, but in the usage by a professional journalism establishment that is unrelated to the title of the piece.

sunyc• 13 years ago

one of my server got exposed too, it was being queried for ripe.net

ajross• 13 years ago

This really is a real issue. My home machine was an open recursor for a while too. I set up a dnsmasq installation and forgot to set an "except-interface" to restrict it to the internal network.

I even like to think I know this stuff well, but still got burned. I'm sure at the time my security analysis (if I even thought of the externally-facing issue) was "who cares if I expose a caching nameserver with no sensitive content to the rest of the internet?".

unethical_ban• 13 years ago

Some have suggested that DNS move to TCP, but I don't think that's proper. The nature of DNS lends itself to connectionless, lightweight communication. That said, could the next iteration of DNS implement application-level handshaking?

The reason not to do this at layer 4 is because I, in the several minutes of pondering it, think it could break lots of security devices that track connection state across lots of computers in a network. Make some kind of

  C -> S request  
  C <- S ack 
  C -> S yes  
  C <- S lots of data  
  done

  C -> S request  
  C <- S ack
  C -> S no  
  done

drdaeman• 13 years ago

Unfortunately, round-trip time is still important, too. I suspect, almost doubling the DNS request time may cause problems in some cases.

metalruler• 13 years ago

I don't understand why it's necessary for the server to be open, and have recursion enabled. I run a couple of authoritative name servers and have seen them used for amplification attacks. Sure, it's not as easy as querying every open recursive DNS server you can find for <single_domain_with_huge_sized_reply>.com, but there's still (literally) billions of unique hostnames on the internet which can be resolved "legitimately" via their authoritative name servers. There is no magical config option to prevent this; the only way to block this type of activity is to analyze traffic to find IPs that are repeatedly sending the same [spoofed] request.

IT Pro confession: I contributed to the DDOS attack against Spamhaus

Related Stories