AOH :: ISN-2830.HTM

DNS amplification attacks explained

DNS amplification attacks explained
DNS amplification attacks explained

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.

Content-Type: TEXT/PLAIN; charset=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE 

By Charlie Demerjian 
Las Vegas
06 August 2006

YOU MAY HAVE heard about a class of attacks called DNS amplification 
attacks recently, they are a real nasty and subtle class of DDOS attack. 
Like ping flooding and smurfing they depend on sending large amounts of 
data across a pipe and drowning out any legit data.

You may notice he amplification part in the name, and that is the key 
here. What it does is turn a few bytes of data into a stream many times as 
large. In the case of the one discussed at Defcon, it took a 20 byte 
packet and turned it into 8.5K, with this ratio, you can take a cable 
modem and turn it into gigs a second of traffic. Toss a botnet into this, 
and you can crush the life out of any target you want.

The mechanism it works on is pretty simple. There is a DNS query of a type 
called 'any', and in the real world, it is pretty useless. If you send 
that query to an authoritative DNS server, it will return anything it has, 
which is everything. If you send it to a non-authoritative source, it 
simply returns what it has, usually little or nothing.

One other thing to note is that DNS as was originally specified has a 512 
byte maximum message size. This was later extended so that if you needed 
more, it could do that. If your server didn't like the extended size, it 
would stop using UDP and set up a TCP connection, hugely expensive in 
computational terms, to send the data.

What the amp attacks do is hack an authoritative server and put in a large 
text field on a record, not large in the MS Word sense, but a few K of 
text. One person in the audience said he scans DNS servers, and on one he 
found large chunks of the book of revelations in a record. This probably 
is not RFC compliant, but the text with the four horsemen used as a DDOS 
is more than mildly ironic.

The next stage is a little more complex, you take a list of open DNS 
servers and query them for the record you hacked. They dutifully go out 
and look it up, download a few K of text, answer the query, and cache the 
answer. It isn't hard to find a few thousand of these, so you effectively 
have a botnet.

>From that point, you take a real botnet, or at least a few machines,
and spoof a few packets. Those spoofs are a simple DNS query for the 
record that you cached earlier, and the spoofed return address is the 
victim. Repeat on a massive scale, and the victim is flooded with huge DNS 

With the overhead of TCP sucking up CPU time, and an amplification factor 
of tens to hundreds, you can take a few meg of traffic and turn it into 
gigs. The victim is flooded into the ground, and there is squat all they 
can do other than sit it out and wait. DNS amplification attacks are quite 
effective and fairly easy to pull off, just what we all need for a safe 
and happy internet. =C2=B5

Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Visit the InfoSec News store! 


Site design & layout copyright © 1986-2014 CodeGods