Going Wild

Kührer, Marc; Hupperich, Thomas; Bushart, Jonas; Rossow, Christian; Holz, Thorsten

doi:10.1145/2815675.2815683

Cited by 91 publications

(32 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If the encoded IP address of the scan target and the source IP address of the resolver querying our ANS are identical, then the resolver is an open recursive resolver, otherwise the encoded IP address belongs to an open forwarding resolver. We expect a much higher number of open resolvers than recursive resolver, because as Kührer et al [24] found, most open resolvers are routers or other embedded devices. There is little reason for them to host a recursive resolver, because they require more resources.…”

Section: Amplificationmentioning

confidence: 94%

“…Response Rate Limiting (RRL) is an effective technique to counter standard DNS-based amplification attacks. If DNS servers are abused for reflective amplification attacks [24,44], the attacker sets the request's source to the IP address of the victim. In turn, resolvers unknowingly flood the victim with DNS responses.…”

Section: Response Rate Limiting (Rrl)mentioning

confidence: 99%

“…They cover approaches to combat the bandwidth exhaustion, like client puzzles, or prevent source address spoofing. In the context of DNS, Kührer et al [24,25] analyzed the amplification potential of DNS resolvers. They found millions of open DNS resolver on embedded devices or routers, meaning the openness of the resolver is likely a configuration issue.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

DNS Unchained: Amplified Application-Layer DoS Attacks Against DNS Authoritatives

Bushart

Rossow

2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

We present DNS Unchained, a new application-layer DoS attack against core DNS infrastructure that for the first time uses amplification. To achieve an attack amplification of 8.51, we carefully chain CNAME records and force resolvers to perform deep name resolutionseffectively overloading a target authoritative name server with valid requests. We identify 178 508 potential amplifiers, of which 74.3% can be abused in such an attack due to the way they cache records with low Time-to-Live values. In essence, this allows a single modern consumer uplink to downgrade availability of large DNS setups. To tackle this new threat, we conclude with an overview of countermeasures and suggestions for DNS servers to limit the impact of DNS chaining attacks.

show abstract

Section: Amplificationmentioning

confidence: 94%

Section: Response Rate Limiting (Rrl)mentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

DNS Unchained: Amplified Application-Layer DoS Attacks Against DNS Authoritatives

Bushart

Rossow

2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…Several studies have investigated open DNS resolvers. Kührer et al [24] classify open DNS resolvers based on the authenticity of their responses and the software that these resolvers are running. Similarly, [32] investigates open DNS resolvers that respond with incorrect answers.…”

Section: Related Workmentioning

confidence: 99%

“…To derive logical and consistent results, we note that there is a timecritical dependency between the open resolver identification and the systematic testing of amplification power steps of our data collection methodology. Previous studies have revealed that there is considerable IP churn among open resolvers [24,25], which entails that any meaningful interaction with the open resolvers that we discover needs to happen as close as possible in time to the identifying scan. We therefore run the systematic testing of amplification power step on the same day as the open resolver identification.…”

Section: Scanning and Testing Open Resolversmentioning

confidence: 99%

A Matter of Degree: Characterizing the Amplification Power of Open DNS Resolvers

Yazdani

Rijswijk-Deij

Jonker

et al. 2022

Passive and Active Measurement

View full text Add to dashboard Cite

Open DNS resolvers are widely misused to bring about reflection and amplification DDoS attacks. Indiscriminate efforts to address the issue and take down all resolvers have not fully resolved the problem, and millions of open resolvers still remain available to date, providing attackers with enough options. This brings forward the question if we should not instead focus on eradicating the most problematic resolvers, rather than all open resolvers indiscriminately. Contrary to existing studies, which focus on quantifying the existence of open resolvers, this paper focuses on infrastructure diversity and aims at characterizing open resolvers in terms of their ability to bring about varying attack strengths. Such a characterization brings nuances to the problem of open resolvers and their role in amplification attacks, as it allows for more problematic resolvers to be identified. Our findings show that the population of open resolvers lies above 2.6M range over our one-year measurement period. On the positive side, we observe that the majority of identified open resolvers cut out when dealing with bulky and DNSSEC-related queries, thereby limiting their potential as amplifiers. We show, for example, that 59% of open resolvers lack DNSSEC support. On the downside, we see that a non-negligible number of open resolvers facilitate large responses to ANY and TXT queries (8.1% and 3.4% on average, respectively), which stands to benefit attackers. Finally we show that by removing around 20% of potent resolvers the global DNS amplification potential can be reduced by up to 80%.

show abstract