Server Denial of Service Attacks (DDoS)
Recently, I have seen some Distributed Denial Of Service (DDoS) attacks, using the Domain Name Resolution Services (DNS). It appears that they are getting more common. By using intimidation techniques, they can be very disruptive to the targeted machines. They can also impact the machines recruited to participate.
The basic scenario is that open DNS servers are located, and fake DNS lookup requests are sent. The meaning of "open", is that the DNS server will reply to request for name resolution for anywhere. In a secured DNS server, if it receives a request to resolve a name that is outside of the domain that it is setup for, it will refuse to do so. An open server, on the other hand, will do the name lookup, and send the results back. In other words, an open server, when asked to resolve http://www.google.com, for example, will do so even though it is not one of Google’s name servers.
Normally, that is not much of an issue. The problem in a DNS amplification attack, is the DNS request is crafted in such a way, that the amount of data sent back, is much larger than the amount sent in the request. There are various methods used, but the idea is to send, say, 50 bytes, and get a reply of 1,000 bytes back. So, the amplification is 20:1 in that case.
Once an open server is located, and able to be amplified, then the attack is begun on a target. The DNS request is sent to the open server. However, the sender’s IP address is spoofed, so that it appears to be coming from the target machine. The DNS request is received by the open server, which looks it up, and sends the result to the target machine. The target machine then receives an answer to a question that it did not ask, and discards it. However, the information that it was sent, took up some of its bandwidth and resources.
Okay, so now you have a machine getting, say, 1,000 bytes that it did not ask for. Not that much of a problem. However, these attacks are normally carried out via botnets. So, if the botnet has 10,000 computers in it, and they are told to trigger the same time, the target computer gets hit with 100,000 bytes it did not ask for. More bandwidth and resources used.
In reality, the botnets are often much larger. Also, they do not send just one DNS request to one open server. Instead, they send thousands of request to hundreds, or thousands, of servers. There are reports of the target servers receiving false answers at rates into the gigabits-per-second range. That would effectively cripple all but the biggest data centers.
The reason that attacks like this are relatively easy to carry out, is that there are a huge number of open DNS servers out there. So, if you are running a DNS server, you need to make sure that it is not open, and susceptible to being recruited into these attacks. Remember, if it is recruited, it is your resources that are being used, too.
Contact CCS Retail Systems for all your support needs.
Dave.