Attacks/Breaches
10/21/2013
11:53 AM
Martin Lee
Martin Lee
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Is Your DNS Server A Weapon?

As we improve our defenses against distributed-denial-of-service (DDoS) attacks, the bad guys adapt and step up their game, too. Here's how to use your domain name servers to ward off hackers.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
Distributed denial of service (DDoS) attackers aim to either overload the CPU or clog networks with irrelevant traffic. These attackers often control large numbers of computers that are part of botnets and instruct them to make repeated requests to a website, overloading networks and processing power. However, security teams can fight back by blocking connections from botnet IP addresses to protect bandwidth and ignoring repeat requests to the same URL to protect processing power.

As a result, to conduct a successful denial of service attack, attackers must amplify the effect of the resources under their control. One way that can happen: DNS amplification.

DNS requests are an ideal mechanism by which attackers can increase the amount of traffic thrown at their victims, while hiding the origin of the attack. Many DNS servers on the Internet are configured as "open resolvers" that accept and respond to DNS queries from anywhere on the Internet. Sending very small requests to these servers can result in large replies that can be directed toward a victim's systems.

For example, the short query to retrieve DNS information for the domain InformationWeek.com:

dig ANY informationweek.com

Results in a large amount of information being returned:

;; ANSWER SECTION:

informationweek.com. 11334 IN NS ns2.ubm-us.net.

informationweek.com. 11334 IN NS ns1.ubm-us.net.

informationweek.com. 11334 IN NS ns3.ubm-us.net.

informationweek.com. 11334 IN SOA ns1.ubm-us.net. dnsadmin.ubm-us.net. 201310100 1800 900 1209600 1800

informationweek.com. 11334 IN A 192.155.48.18

informationweek.com. 11334 IN AAAA 2620:103::192:155:48:18

informationweek.com. 11334 IN MX 10 mailhost.ubm-us.net.

informationweek.com. 11334 IN TXT "v=spf1 mx include:spf.ubm-us.net -all"

informationweek.com. 11334 IN TXT "google-site-verification=doCdAIQ4FJ3yo-047WoLHDdjRLjR_A9qHK-PIIlYLmU"

;; Query time: 0 msec

;; SERVER: 10.30.40.15#53(10.30.40.15)

;; WHEN: Thu Oct 17 03:31:00 2013

;; MSG SIZE rcvd: 346

In this case, sending a 45-byte DNS request packet results in 346 bytes of DNS information being returned, amplifying the amount of returned data compared with the size of the request by a factor of 7.7.

Including other information in DNS records, such as cryptographic keys to comply with DNSSEC or DKIM standards, enlarges the response from the DNS server. A query for any DNS information for the domain whitehouse.gov results in 2877 bytes of information being returned, an amplification factor of 71.9 compared with the request.

DNS queries are sent as UDP packets, meaning that the source of the request is not verified by a handshake in the same way as TCP, allowing the origin to be falsified. Members of a botnet can spoof DNS requests to appear to have come from a victim's IP address, causing DNS replies to be sent to that address rather than to the address of the request originator. Hence, a small botnet can cause a large amount of data to be sent to the victim's network; a large botnet can deluge a victim with an enormous amount of data.

In essence, the attack is similar to using many Post-It notes to request entire Yellow Pages directories to be sent to a mailing address, rendering victims unable to perform their usual activities due to the sheer volume of delivered directories.

Secure Your DNS

Amplified DNS-based denial of service attacks are particularly difficult to defend against, because such attacks consist of large volumes of legitimate data sent from legitimate sources. These attacks are possible due to the large number of DNS servers configured to be open resolvers, responding to DNS requests without regard to the origin of the request.

The Open Resolver Project has identified 28 million DNS servers that pose a significant threat of being used in such an attack. Companies should ensure that their DNS servers are not among those capable of contributing to a denial of service attack by taking the following steps:

-- Limit recursion to only authorized clients, such as trusted networks and known DNS servers.

-- Identify and reject packets with spoofed IP addresses by verifying the IP address of their sources.

-- Limit the response rate of DNS servers so that they can't flood networks.

-- Limit the size of outbound DNS messages so that suspiciously large DNS replies are blocked.

Further, check the status of your DNS servers by scanning them from a remote network with nmap, replacing x.x.x.x with the IP address of your server:

nmap -sU -p 53 -P0 --script "dns-recursion" x.x.x.x

This uses the dns-recursion script included in default nmap installations to send UDP packets to port 53 and report if the ability to perform recursive queries is detected. A reply containing the phrase:

"Recursion appears to be enabled"

denotes that a server might be able to be abused

Ready, Set, Defend

Consider the ramifications of such an attack against your systems now, and prepare a defense-in-depth strategy. Distribute highly visible public-facing systems, such as websites, across the world via a content delivery network with enough bandwidth to withstand attack. Work with your providers to ensure that attacks against corporate networks are detected and blocked as far upstream as possible. It is also vital to detect traffic anomalies as soon as possible -- attacks might be preceded by transient peaks in traffic as attackers check that their systems are operational before launching a full assault. Automated detection of anomalous traffic can alert operators to take action and execute a prepared remediation plan.

Attackers are adept at exploiting Internet protocols that were designed for a benign world. To defend against these attacks, do your best to harden your systems. And when attacks occur, ensure that you're able to call on more resources and expertise than are available to the attackers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Chuck Brooks
50%
50%
Chuck Brooks,
User Rank: Apprentice
10/28/2013 | 11:38:21 PM
re: Is Your DNS Server A Weapon?
Distributed denial of service (DDoS) attacks are becoming increasingly focused and sophisticated. Many CISOs at corporations see such attacks as a top threat. Martin's suggestion of blocking connections from botnet IP addresses to protect bandwidth and ignoring repeat requests to the same URL to protect processing power is a good one. Future development of automated enterprise encryption may also become a solution to hardening systems.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

CVE-2012-5702
Published: 2014-10-21
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to i...

CVE-2013-7406
Published: 2014-10-21
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-4514
Published: 2014-10-21
Cross-site scripting (XSS) vulnerability in includes/api_tenpay/inc.tenpay_notify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.