Resolvers Revealed

Shue, Craig A.; Kalafut, Andrew J.

doi:10.1145/2499926.2499928

Cited by 17 publications

(1 citation statement)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…CNAME Chaining: The possibility to chain CNAME RRs is well-known and documented. For example, Shue and Kalafut [46] use differences in recursion strategies to fingerprint resolver implementations. Dagon et al [8] use CNAME chains to amplify the number of queries from each resolver.…”

Section: Related Workmentioning

confidence: 99%

DNS Unchained: Amplified Application-Layer DoS Attacks Against DNS Authoritatives

Bushart

Rossow

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We present DNS Unchained, a new application-layer DoS attack against core DNS infrastructure that for the first time uses amplification. To achieve an attack amplification of 8.51, we carefully chain CNAME records and force resolvers to perform deep name resolutionseffectively overloading a target authoritative name server with valid requests. We identify 178 508 potential amplifiers, of which 74.3% can be abused in such an attack due to the way they cache records with low Time-to-Live values. In essence, this allows a single modern consumer uplink to downgrade availability of large DNS setups. To tackle this new threat, we conclude with an overview of countermeasures and suggestions for DNS servers to limit the impact of DNS chaining attacks.

show abstract

Section: Related Workmentioning

confidence: 99%

DNS Unchained: Amplified Application-Layer DoS Attacks Against DNS Authoritatives

Bushart

Rossow

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

Don’t Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic

Korczyński

Nosyk

Lone

et al. 2020

Passive and Active Measurement

View full text Add to dashboard Cite

This paper concerns the problem of the absence of ingress filtering at the network edge, one of the main causes of important network security issues. Numerous network operators do not deploy the best current practice-Source Address Validation (SAV) that aims at mitigating these issues. We perform the first Internet-wide active measurement study to enumerate networks not filtering incoming packets by their source address. The measurement method consists of identifying closed and open DNS resolvers handling requests coming from the outside of the network with the source address from the range assigned inside the network under the test. The proposed method provides the most complete picture of the inbound SAV deployment state at network providers. We reveal that 32 673 Autonomous Systems (ASes) and 197 641 Border Gateway Protocol (BGP) prefixes are vulnerable to spoofing of inbound traffic. Finally, using the data from the Spoofer project and performing an open resolver scan, we compare the filtering policies in both directions.

show abstract

Characterizing Optimal DNS Amplification Attacks and Effective Mitigation

MacFarland

Shue

Kalafut

2015

Passive and Active Measurement

Self Cite

View full text Add to dashboard Cite

Attackers have used DNS amplification in over 34% of highvolume DDoS attacks, with some floods exceeding 300Gbps. The best current practices do not help victims during an attack; they are preventative measures that third-party organizations must employ in advance. Unfortunately, there are no incentives for these third parties to follow the recommendations. While practitioners have focused on reducing the number of open DNS resolvers, these efforts do not address the threat posed by authoritative DNS servers. In this work, we measure and characterize the attack potential associated with DNS amplification, along with the adoption of countermeasures. We then propose and measure a mitigation strategy that organizations can employ. With the help of an upstream ISP, our strategy will allow even poorly provisioned organizations to mitigate massive DNS amplification attacks with only minor performance overheads.

show abstract

Resolvers Revealed

Cited by 17 publications

References 20 publications

DNS Unchained: Amplified Application-Layer DoS Attacks Against DNS Authoritatives

DNS Unchained: Amplified Application-Layer DoS Attacks Against DNS Authoritatives

Don’t Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic

Characterizing Optimal DNS Amplification Attacks and Effective Mitigation

Contact Info

Product

Resources

About