Attacks/Breaches
10/21/2013
11:53 AM
Martin Lee
Martin Lee
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Is Your DNS Server A Weapon?

As we improve our defenses against distributed-denial-of-service (DDoS) attacks, the bad guys adapt and step up their game, too. Here's how to use your domain name servers to ward off hackers.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
Distributed denial of service (DDoS) attackers aim to either overload the CPU or clog networks with irrelevant traffic. These attackers often control large numbers of computers that are part of botnets and instruct them to make repeated requests to a website, overloading networks and processing power. However, security teams can fight back by blocking connections from botnet IP addresses to protect bandwidth and ignoring repeat requests to the same URL to protect processing power.

As a result, to conduct a successful denial of service attack, attackers must amplify the effect of the resources under their control. One way that can happen: DNS amplification.

DNS requests are an ideal mechanism by which attackers can increase the amount of traffic thrown at their victims, while hiding the origin of the attack. Many DNS servers on the Internet are configured as "open resolvers" that accept and respond to DNS queries from anywhere on the Internet. Sending very small requests to these servers can result in large replies that can be directed toward a victim's systems.

For example, the short query to retrieve DNS information for the domain InformationWeek.com:

dig ANY informationweek.com

Results in a large amount of information being returned:

;; ANSWER SECTION:

informationweek.com. 11334 IN NS ns2.ubm-us.net.

informationweek.com. 11334 IN NS ns1.ubm-us.net.

informationweek.com. 11334 IN NS ns3.ubm-us.net.

informationweek.com. 11334 IN SOA ns1.ubm-us.net. dnsadmin.ubm-us.net. 201310100 1800 900 1209600 1800

informationweek.com. 11334 IN A 192.155.48.18

informationweek.com. 11334 IN AAAA 2620:103::192:155:48:18

informationweek.com. 11334 IN MX 10 mailhost.ubm-us.net.

informationweek.com. 11334 IN TXT "v=spf1 mx include:spf.ubm-us.net -all"

informationweek.com. 11334 IN TXT "google-site-verification=doCdAIQ4FJ3yo-047WoLHDdjRLjR_A9qHK-PIIlYLmU"

;; Query time: 0 msec

;; SERVER: 10.30.40.15#53(10.30.40.15)

;; WHEN: Thu Oct 17 03:31:00 2013

;; MSG SIZE rcvd: 346

In this case, sending a 45-byte DNS request packet results in 346 bytes of DNS information being returned, amplifying the amount of returned data compared with the size of the request by a factor of 7.7.

Including other information in DNS records, such as cryptographic keys to comply with DNSSEC or DKIM standards, enlarges the response from the DNS server. A query for any DNS information for the domain whitehouse.gov results in 2877 bytes of information being returned, an amplification factor of 71.9 compared with the request.

DNS queries are sent as UDP packets, meaning that the source of the request is not verified by a handshake in the same way as TCP, allowing the origin to be falsified. Members of a botnet can spoof DNS requests to appear to have come from a victim's IP address, causing DNS replies to be sent to that address rather than to the address of the request originator. Hence, a small botnet can cause a large amount of data to be sent to the victim's network; a large botnet can deluge a victim with an enormous amount of data.

In essence, the attack is similar to using many Post-It notes to request entire Yellow Pages directories to be sent to a mailing address, rendering victims unable to perform their usual activities due to the sheer volume of delivered directories.

Secure Your DNS

Amplified DNS-based denial of service attacks are particularly difficult to defend against, because such attacks consist of large volumes of legitimate data sent from legitimate sources. These attacks are possible due to the large number of DNS servers configured to be open resolvers, responding to DNS requests without regard to the origin of the request.

The Open Resolver Project has identified 28 million DNS servers that pose a significant threat of being used in such an attack. Companies should ensure that their DNS servers are not among those capable of contributing to a denial of service attack by taking the following steps:

-- Limit recursion to only authorized clients, such as trusted networks and known DNS servers.

-- Identify and reject packets with spoofed IP addresses by verifying the IP address of their sources.

-- Limit the response rate of DNS servers so that they can't flood networks.

-- Limit the size of outbound DNS messages so that suspiciously large DNS replies are blocked.

Further, check the status of your DNS servers by scanning them from a remote network with nmap, replacing x.x.x.x with the IP address of your server:

nmap -sU -p 53 -P0 --script "dns-recursion" x.x.x.x

This uses the dns-recursion script included in default nmap installations to send UDP packets to port 53 and report if the ability to perform recursive queries is detected. A reply containing the phrase:

"Recursion appears to be enabled"

denotes that a server might be able to be abused

Ready, Set, Defend

Consider the ramifications of such an attack against your systems now, and prepare a defense-in-depth strategy. Distribute highly visible public-facing systems, such as websites, across the world via a content delivery network with enough bandwidth to withstand attack. Work with your providers to ensure that attacks against corporate networks are detected and blocked as far upstream as possible. It is also vital to detect traffic anomalies as soon as possible -- attacks might be preceded by transient peaks in traffic as attackers check that their systems are operational before launching a full assault. Automated detection of anomalous traffic can alert operators to take action and execute a prepared remediation plan.

Attackers are adept at exploiting Internet protocols that were designed for a benign world. To defend against these attacks, do your best to harden your systems. And when attacks occur, ensure that you're able to call on more resources and expertise than are available to the attackers.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Chuck Brooks
50%
50%
Chuck Brooks,
User Rank: Apprentice
10/28/2013 | 11:38:21 PM
re: Is Your DNS Server A Weapon?
Distributed denial of service (DDoS) attacks are becoming increasingly focused and sophisticated. Many CISOs at corporations see such attacks as a top threat. Martin's suggestion of blocking connections from botnet IP addresses to protect bandwidth and ignoring repeat requests to the same URL to protect processing power is a good one. Future development of automated enterprise encryption may also become a solution to hardening systems.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio