MESSAGE
| DATE | 2013-03-30 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [NYLXS - HANGOUT] [rick@linuxmafia.com: Re: BIND options]
|
I wrote:
> This is from one of the include files of my BIND configuration.
> You could put it into /etc/bind/named.conf . (198.144.195.186/29
> is my public IP netblock.)
About the Spamhaus attacks: They are made possible by one majorly bad
thing and one minorly bad one.
Majorly bad: ISPs and backbone providers not bothering to do ingress
filtering at their BGP routers. Explanation: It should not be possible
to route a forged IP packet across backbones, because router operators
should reject/drop packets claiming to come from impossible IPs (that
are not valid arriving on that interface). This isn't brain-surgery
and is basic quality-control. And yet, apparently some of these guys
do only egress filtering. Bad! Stupid!
Minorly bad: People operating 'open' recursive DNS resolvers who do not
need to, and who are not ready/willing/able to do their own ingress
filtering (which is in practice feasible only to peering ISPs running
BGP), or at least rate filtering/monitoring.
Minorly bad (variant): SOHO gateways and WAPs with embedded Linux or
BSD or similar distros often have DNS forwarder software (dproxy or
Dnsmasq) that is often misconfigured to answer queries arriving on the
public-facing interface. Those queries are then forwarded to recursive
DNS resolvers as detailed in the prior paragraph.
The two of those things (major and minor) jointly permit abusing other
people recursive nameservers as attack reflectors, very efficiently
because most DNS is done using UDP hence damned near zero overhead and
no handshake checking.
In fact, it's not only an efficient form of attack but also offers
amplification via some means I do not yet fully understand where the bad
guys' 10 bytes of DNS query with a forged source IP generated 1000 bytes
of return value, or 100x amplification factor.
I'll eventually read more about the technical details of these DDoS
attacks. Unfortunately, most of what's written on the subject is
either rubbish or vague.
|
|
