Slashdot Mirror
DDoS Attacks Via DNS Recursion
JehCt writes "Associated Press is running a story about how the recursion feature of open DNS servers can be used to launch massive distributed denial of service (DDoS) attacks: 'First detected late last year, the new attacks direct such massive amounts of spurious data against victim computers that even flagship technology companies could not cope.' A thread at WebmasterWorld explains, 'To make a long story short, having a DNS server that allows recursion for the Internet is like running an open SMTP relay.'"
That's why you run djbdns -- by default it's closed to recursive queries.
Don't piss off The Angry Economist
OK, don't do that then.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
recursion: n.
See recursion. See also tail recursion.
From the Jargon File.
having a DNS server that allows recursion for the Internet is like running an open SMTP relay.'
Anyone want to discuss how DNS Cache addresses this? AFAIK this is a pretty "safe" way to provide DNS to at least a small sized network - but that's all I run it on. Comments, concerns, advice?
fak3r.com
I am quite a fan of djbns, but the key here is to separate authoritative and
recursive, which is something that DJB has been preaching for a while.
Consequently djbdns won't do this, but it is quite possible to make bind not
do this also. (In fact Bind now has come round and reccomended this.)
It seems to me like a no-brainer, why is splitting the two such a problem?
SDNS wouldn't hurt either, but that will take a lot more doing.
Put this line in your zone definition:
recursion no;
Problem solved.
The real risk is perhaps The Final Virus.
it's a blue bright blue Saturday hey hey
With his weird license? God. He writes good software. He's even a bloody certified genius, but he's amost as insufferable as Dave Weiner. Don't try and submit a patch - unless you are just donating to his case, and want nothing as a contributor. Also, be prepared for the contempt of his responses.
Besides, who wants software written by a cartoon bear?
"Speaking the Truth in times of universal deceit is a revolutionary act." -- George Orwell
That's self-referential, not recursive. One does not immediately imply the other. GNU, on the other hand, is recursive.
Javascript + Nintendo DSi = DSiCade
No compromise needed. You just send requests to the DNS server spoofing yourself as the victim's IP. (UDP is much easier to spoof, and can be sent out very quickly.) The replies, which are some 30 times larger than the requests, get sent to the spoofed IP (victim). It is a classic form of amplification attack.
Another problem:
(Quoting a post on the other site)"they can send a 70 byte packet to your DNS server, and your DNS server will send a 500+ byte packet to the victim. With EDNS0, that can be 4,000+ bytes.
So with a dialup account, it would be possible to saturate a T1.
There's plenty of ways for them to mess with you without any 'compromised' machines on your network.
To know recursion, you must first know recursion.
/.ers will know that only the mighty foot of Chuck Norris is powerful enough to kick back such a massive DDoS attack. There is a problem though: since there is only 1 of him, Chuck can't defend more than one site at a time. And ofcourse his ourly rates are a bit steep, too.
Vary your mileage may.His license forbids distributing binaries unless they are made from his sources. You want to add any of the many well known patches? Great, you distribute his source and your patches, you do not distribute patched sources and you do not distribute binaries.
No way is DJB software public domain.
In fact, I bet a dollar you don't even know what public domain is.
Infuriate left and right
The first rule of recursion is to not talk about recursion...
~S
Correct. Here is the CERT writeup from 2000.
Intron: the portion of DNA which expresses nothing useful.
When is a spade not a spade? If someone engages in puerile activity, don't they deserve a puerile name? djb (the old djb, anyway)'s biggest problem is that he didn't give people the truth gently. He would tell people "That's stupid, and you're being stupid for proposing it." The best djb quip I ever heard was:
djbwm - it's the best window manager in the world, but when you try to move a window, it argues with you for ten minutes that it was already in the right place.
Don't piss off The Angry Economist
For enterprise systems a split-split DNS design is the best. There are three components to this design:
ADVERTISER
RESOLVER
INTERNAL
The advertiser sits outside, Internet-facing, and is only responsible for resolving outside queries for your own domains. It does not do recursion or dynamic updates, and has a secured cache.
The resolver and internal sit inside, are intranet-facing, and handle internal requests for outside domains, and internal requests for internal domains respectively.
There are lots of articles on-line which show how to set this up.
I am not interested in articles about life extension advancements.
That's a self-referential paradox, not a recursive statement. The grandparent is an example of a recursive statement.
Javascript + Nintendo DSi = DSiCade
Should have used gotos! -1 for the functional language weenies!
Lets say that your local LAN and WLAN networks are 192.168.0/24 and 192.168.1/24, respectively. Make the following additions to your /etc/bind/named.conf.options (or equivalent):
-- -pjk Perry Kundert perry@kundert.ca http://kundert.2y.net
This is old news. If you're running an open DNS server, you're very likely participating in someonelse's DDoS attack and have been for the last couple years. We bought a company last year and part of my job was to assimilate their DNS systems that were reportedly flaking out constantly. I can't speak to the people running the servers before me, but the diagnosis was easy. Once we turned off recursion and convinced the network not to let spoofed UDP packets enter the network, the attacks stopped instantly.
Yeah, but we're not talking about copying which falls under fair use. Incorporating a copy of code into a unidiff patch would be fair use (commentary). Making a copy of a djb subroutine for pedantic purposes ("see how he does this") would be fair use. Making a copy of code which is no longer for sale and cannot be purchased for any reasonable price might be fair use. Making a copy of code which is freely downloadable elsewhere -- even if you use it to create a derived work -- is almost certainly not fair use. Fair use always ends up being a judgment call on part of a judge. You'd always prefer not to have to rely on fair use.
Don't piss off The Angry Economist
http://www.dnsreport.com/tools/dnsreport.ch?domain =slashdot.org
FAIL Open DNS servers ERROR: One or more of your nameservers reports that it is an open DNS server. This usually means that anyone in the world can query it for domains it is not authoritative for (it is possible that the DNS server advertises that it does recursive lookups when it does not, but that shouldn't happen). This can cause an excessive load on your DNS server. Also, it is strongly discouraged to have a DNS server be both authoritative for your domain and be recursive (even if it is not open), due to the potential for cache poisoning (with no recursion, there is no cache, and it is impossible to poison it). Also, the bad guys could use your DNS server as part of an attack, by forging their IP address. Problem record(s) are:
Server 66.35.250.12 reports that it will do recursive lookups. [test]
Server 12.152.184.136 reports that it will do recursive lookups. [test]
Server 12.152.184.135 reports that it will do recursive lookups. [test]
See this page for info on closing open DNS servers.
Back in the bind 4 days, when I did serious DNS, my company wanted a few servers visible in their domain(s) for external dns host resolution.
For people behind the firewall, they wanted a far more extensive list of hosts that were not to be seen for queries outside the firewall.
I did this by using scp to transfer the zone files from the external to the internal DNS server; the internal server would then "cat" the additional hosts to the zone and HUP the named.
AFAIK modern BIND uses "zones" so you can accomplish the above on one server, if you want. I've never used it, but I can see a number of situations where I'd need my above solution even with this feature.
What BIND needs is not a "recursion no;" option, but instead a "recursion eth0;" or "recursion 1.2.3.*;" so recursive queries must originate from a trusted network.
Remember also that not everyone in the world uses BIND - people with ActiveDirectory or NDS name servers might be screwed until a vendor patch.
view "internal" {
match-clients {
10.0.0.0/8;
};
recursion yes;
zone "example.com" {
yadda yadda yadda;
};
};
view "external" {
match-clients {
any;
};
recursion no;
zone "example.com" {
blah blah blah;
};
};
<xml><I><am><so><damn>Web 2.0</damn></so></am></I></xml>
This isn't just a simple DDoS because DNS servers point many other resources to the attack target. This makes this a Distributed Reflective Denial of Service Attack, or DRDoS. I published an article on this topic in 2600 Hacker Quarterly magazine in 2004. I was a network\security student when I wrote it so it might not teach you ubergeeks anything new.
http://hyppy.zapto.org/DRDoS-Spyrochaete.html
There already is a fix in BIND (at least in the 9.2.4 release shipped with RHEL 4 & all like distros). Just add this to your "options" section of your bind.conf:
allow-recursion { localhost; mygroup; 10.10.10.1; 10.2.3.0/24; };
This would allow the localhost, the machines on the mygroup ACL, one computer at 10.10.10.1 and all the hosts in 10.2.3.0/24 access to recursive queries.
If you don't need to provide recursive lookups at all, you can just use this:
recursion no;
[End of diatribe. We now return you to your regularly scheduled programming...] - Larry Wall in Configure from the perl
In Bind9 you don't have to return cached data, so though it happens by default you can turn it off ("additional-from-cache"):
view "internal" {
match-clients { internals; guests; };
recursion yes;
zone "." {
type hint;
file "bootstrap/cache";
};
zone "example.com"{
type master;
file "example-int.com";
};
};
view "external" {
match-clients { any; };
recursion no;
additional-from-auth no;
additional-from-cache no;
zone "example.com"{
type master;
file "example-ext.com";
allow-query { any; };
};
};
---------
I believe that should prevent bind from being too useful from the outside.
As previous posters have noted, these attacks have become more frequent in recent months, prompting an advisory from US-CERT (PDF) in December. It's a hot topic on several security lists, and a special focus of SecuriTeam blogger Gadi Evron.
RichM
Data Center Knowledge
That's "another compromise"... IP Spoofing hasn't a f***ing thing to do with DNS recursion. One can just as easily spoof your address in a non-recursive request.
> In Bind9 you don't have to return cached data, so though it happens by default you can
> turn it off ("additional-from-cache"):
Excellent. The commentary on the aite with the original article didn't seem to know about that trick. So now I just need to make sure I have wrapped my head around all of the details and start making the changes. Going to be a bit of bother this way but managable. Installing another pair of nameservers was right out, this way is doable.
Democrat delenda est