11:53 AM
Martin Lee
Martin Lee
Connect Directly

Is Your DNS Server A Weapon?

As we improve our defenses against distributed-denial-of-service (DDoS) attacks, the bad guys adapt and step up their game, too. Here's how to use your domain name servers to ward off hackers.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
Distributed denial of service (DDoS) attackers aim to either overload the CPU or clog networks with irrelevant traffic. These attackers often control large numbers of computers that are part of botnets and instruct them to make repeated requests to a website, overloading networks and processing power. However, security teams can fight back by blocking connections from botnet IP addresses to protect bandwidth and ignoring repeat requests to the same URL to protect processing power.

As a result, to conduct a successful denial of service attack, attackers must amplify the effect of the resources under their control. One way that can happen: DNS amplification.

DNS requests are an ideal mechanism by which attackers can increase the amount of traffic thrown at their victims, while hiding the origin of the attack. Many DNS servers on the Internet are configured as "open resolvers" that accept and respond to DNS queries from anywhere on the Internet. Sending very small requests to these servers can result in large replies that can be directed toward a victim's systems.

For example, the short query to retrieve DNS information for the domain

dig ANY

Results in a large amount of information being returned:

;; ANSWER SECTION: 11334 IN NS 11334 IN NS 11334 IN NS 11334 IN SOA 201310100 1800 900 1209600 1800 11334 IN A 11334 IN AAAA 2620:103::192:155:48:18 11334 IN MX 10 11334 IN TXT "v=spf1 mx -all" 11334 IN TXT "google-site-verification=doCdAIQ4FJ3yo-047WoLHDdjRLjR_A9qHK-PIIlYLmU"

;; Query time: 0 msec


;; WHEN: Thu Oct 17 03:31:00 2013

;; MSG SIZE rcvd: 346

In this case, sending a 45-byte DNS request packet results in 346 bytes of DNS information being returned, amplifying the amount of returned data compared with the size of the request by a factor of 7.7.

Including other information in DNS records, such as cryptographic keys to comply with DNSSEC or DKIM standards, enlarges the response from the DNS server. A query for any DNS information for the domain results in 2877 bytes of information being returned, an amplification factor of 71.9 compared with the request.

DNS queries are sent as UDP packets, meaning that the source of the request is not verified by a handshake in the same way as TCP, allowing the origin to be falsified. Members of a botnet can spoof DNS requests to appear to have come from a victim's IP address, causing DNS replies to be sent to that address rather than to the address of the request originator. Hence, a small botnet can cause a large amount of data to be sent to the victim's network; a large botnet can deluge a victim with an enormous amount of data.

In essence, the attack is similar to using many Post-It notes to request entire Yellow Pages directories to be sent to a mailing address, rendering victims unable to perform their usual activities due to the sheer volume of delivered directories.

Secure Your DNS

Amplified DNS-based denial of service attacks are particularly difficult to defend against, because such attacks consist of large volumes of legitimate data sent from legitimate sources. These attacks are possible due to the large number of DNS servers configured to be open resolvers, responding to DNS requests without regard to the origin of the request.

The Open Resolver Project has identified 28 million DNS servers that pose a significant threat of being used in such an attack. Companies should ensure that their DNS servers are not among those capable of contributing to a denial of service attack by taking the following steps:

-- Limit recursion to only authorized clients, such as trusted networks and known DNS servers.

-- Identify and reject packets with spoofed IP addresses by verifying the IP address of their sources.

-- Limit the response rate of DNS servers so that they can't flood networks.

-- Limit the size of outbound DNS messages so that suspiciously large DNS replies are blocked.

Further, check the status of your DNS servers by scanning them from a remote network with nmap, replacing x.x.x.x with the IP address of your server:

nmap -sU -p 53 -P0 --script "dns-recursion" x.x.x.x

This uses the dns-recursion script included in default nmap installations to send UDP packets to port 53 and report if the ability to perform recursive queries is detected. A reply containing the phrase:

"Recursion appears to be enabled"

denotes that a server might be able to be abused

Ready, Set, Defend

Consider the ramifications of such an attack against your systems now, and prepare a defense-in-depth strategy. Distribute highly visible public-facing systems, such as websites, across the world via a content delivery network with enough bandwidth to withstand attack. Work with your providers to ensure that attacks against corporate networks are detected and blocked as far upstream as possible. It is also vital to detect traffic anomalies as soon as possible -- attacks might be preceded by transient peaks in traffic as attackers check that their systems are operational before launching a full assault. Automated detection of anomalous traffic can alert operators to take action and execute a prepared remediation plan.

Attackers are adept at exploiting Internet protocols that were designed for a benign world. To defend against these attacks, do your best to harden your systems. And when attacks occur, ensure that you're able to call on more resources and expertise than are available to the attackers.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Chuck Brooks
Chuck Brooks,
User Rank: Apprentice
10/28/2013 | 11:38:21 PM
re: Is Your DNS Server A Weapon?
Distributed denial of service (DDoS) attacks are becoming increasingly focused and sophisticated. Many CISOs at corporations see such attacks as a top threat. Martin's suggestion of blocking connections from botnet IP addresses to protect bandwidth and ignoring repeat requests to the same URL to protect processing power is a good one. Future development of automated enterprise encryption may also become a solution to hardening systems.
Register for Dark Reading Newsletters
White Papers
Current Issue
Dark Reading Tech Digest September 7, 2015
Some security flaws go beyond simple app vulnerabilities. Have you checked for these?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-09
The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.

Published: 2015-10-09
The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.

Published: 2015-10-09
The API in the WebKit Plug-ins component in Apple Safari before 9 does not provide notification of an HTTP Redirection (aka 3xx) status code to a plugin, which allows remote attackers to bypass intended request restrictions via a crafted web site.

Published: 2015-10-09
The Intel Graphics Driver component in Apple OS X before 10.11 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5877.

Published: 2015-10-09
The Login Window component in Apple OS X before 10.11 does not ensure that the screen is locked at the intended time, which allows physically proximate attackers to obtain access by visiting an unattended workstation.

Dark Reading Radio
Archived Dark Reading Radio
What can the information security industry do to solve the IoT security problem? Learn more and join the conversation on the next episode of Dark Reading Radio.