Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Vuln-Dev
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: recursive DNS servers DDoS as a growing DDoS problem

from [Geo.] Network Security [Permanent Link]
Subject: Re: recursive DNS servers DDoS as a growing DDoS problem
Date: Sun, 26 Mar 2006 11:34:53 -0500 


Spoofing is indeed the attack vector and it can also be utilized for
NTP, ICMP, etc. It is to blame.

Still, DNS is what's being exploited and in my opinion a broken feature
being exploited needs fixing, or it will be exploited.


What feature of DNS is being exploited, UDP or the fact that there are a lot
of dns servers you can use?

If you have a 20,000 bot botnet and each bot has 2 defined recursive dns
servers that it is allowed to use and these bots are on the local subnet (ie
BCP38 is implimented at the gateway but not at every router) then how
exactly is locking down recursive servers so you can only use yours going to
solve anything?

To fix DNS we would have to eliminate it's use of UDP which means pretty
much all internet software would need to be rewritten, that is an
unrealistic goal. Locking down recursive servers may increase the number of
machines required to create a flood but again a large botnet will have no
problem so that's no solution either. BCP38 will accomplish the same
ineffective goal but at least has the added potential to reduce non DNS
related spoofed attacks at the same time making it easier to at least track
down the sources of a distributed flood at least to the provider level if
not to the exact IP.

Geo.
[More messages with this same subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: Sudo tricks, Kyle Wheeler
Next by Date:  SYM06-006, Veritas NetBackup: Multiple Overflow Vulnerabilities in NetBackup Daemons, secure
Previous by Thread:  Re: recursive DNS servers DDoS as a growing DDoS problem, Gadi Evron
Next by Thread:  Re: recursive DNS servers DDoS as a growing DDoS problem, mike davis
Indexes:  [Date] [Thread] [Top] [All Lists]