Keep DNS servers from contributing to a DDoS attack

Takeaway: How can a recursive query become a DDoS attack? It doesn't take much. Mike Mullins explains how an attacker can take advantage of a DNS server using recursion to perpetrate a DDoS attack, and he tells you how to prevent your organization's DNS servers from taking part.

Is your public DNS server just waiting to participate in a distributed denial-of-service (DDoS) attack? If it's using recursion, then the answer is yes. DDoS and DNS attacks aren't new, but they're on the rise.

Using authoritative name service, DNS servers primarily advertise to the world the various records associated with the domain they serve. Because users prefer common names and networks prefer numbers, DNS servers handle the translation between what a user types in a browser—such as techrepublic.com—and the actual IP address the network understands.

The task of answering a query recursively is completely different. According to a US-CERT report, between 75 and 80 percent of all DNS servers can handle recursive requests.

Recursive DNS provide answers to queries for records by asking other DNS servers and providing that response to the client that made the request. Here's an example:

1. A user enters www.techrepublic.com into a Web browser.
2. The computer contacts its local DNS server to determine the IP address of www.techrepublic.com.
3. The DNS server looks up www.techrepublic.com in its local tables (i.e., its cache) but does not find it listed.
4. The DNS server sends a query to a root server for the IP address of www.techrepublic.com.
5. The root server replies with a referral to the top-level domain (TLD) servers for www.techrepublic.com.
6. The DNS server then contacts the TLD server to determine the IP address of www.techrepublic.com.
7. The TLD server replies with a referral to the name server for www.techrepublic.com.
8. The DNS server contacts the name server for www.techrepublic.com to determine the IP address.
9. The name server checks a zone file that defines a CNAME record, which shows www.techrepublic.com is an alias of techrepublic.com.com. DNS returns both the CNAME and the A record for techrepublic.com.com
10. The DNS server sends this response to the original client: techrepublic.com.com = 216.239.113.146 (with CNAME record www.techrepublic.com=techrepublic.com.com).

How can a recursive query become a DDoS attack? For the attack to work, the attacker needs to be in control of one DNS record.

He or she then populates the TXT field of that record with information. (The maximum size of the TXT field is approximately 4,200 bytes.) And then the fun begins. Here's how:

1. The attacker programs bots to continuously execute requests for this record against recursive DNS.
2. The bots spoof the source IP address of these requests, replacing it with the DDoS target.
3. The recursive servers take the record from the attacker-controlled zone, and send it along to the IP address they think the request came from.

Multiply this by the number of bots participating in the attack, and you've got a DDoS attack. If your DNS server is a target of this attack, your network will grind to a halt because none of its clients can resolve an IP address.

What's the solution? It's quite simple: Run two different DNS servers. Let the internal server handle all requests from your network (even recursive for your clients only).

On the external DNS server, disable recursion. With recursion disabled, the external DNS server won't send queries on behalf of other name servers or clients, which stops attackers from bouncing DoS attacks off your DNS server by querying for external zones.

Final thoughts

Open DNS recursion isn't the problem—it's a symptom of the problem. IP address spoofing is the real problem, and this spoofing provides a ready venue for DDoS, spam, and other headaches.

In my opinion, IP address verification is the answer, and the tools already exist to solve that problem. I know the Internet Engineering Task Force (IETF) is looking at the issue, but it needs to stop investigating and take action.

Michael Mullins CCNA, MCP

OQO Model 02 arrives

Posted Jan 7th 2007 9:30PM by Peter Rojas

It's been pretty much exactly two years since we first hassled Jory about this, but OQO officially announced its latest handheld PC, the Model 02. This time they've improved pretty much everything, from the sleek, new black casing and backlit keyboard (with actual keys!), to the brighter LCD screen and integrated EV-DO. Specs have gotten a much needed bump across the board, with the most expensive model they're offering sporting a 1.5GHz VIA processor, 60GB hard drive, 1GB of DDR2 RAM, a 5-inch, 800x480 pixel display (with active digitizer for pen-based input), Bluetooth 2.0, 802.11a/b/g WiFi, integrated EV-DO (courtesy of Sprint), and even an HDMI-out port.

The Model 02 also has a few other slick features, like the ability to zoom to 1000x600 and 1200x720 interpolated modes, a sensor that automatically protects the hard drive in case of a drop, and an optional docking station with a DVD+-RW drive, HDMI and VGA video out, three USB 2.0 ports, and a 3.5mm audio jack.

There are a couple of disappointment -- namely that battery life is a paltry three hours unless you pick up an extended life battery, it's only Vista-capable, not shipping with Vista (at least not initially), and there's no longer a slot for the stylus -- but overall this is the upgrade we've been waiting for. Click on for some more pics, as well as a shot of the OQO in the docking station.

Virtual Windows jalan tanpa modifikasi di Linux

Device drivers yang dikembangkan Novell dan Intel memungkinkan untuk menjalankan Windows Server 2000/2003/XP di lingkungan Xen virtual environments diatas SUSE Linux Enterprise Server 10 dan Intel® Virtualization Technology tanpa perlu modifikasi.

Best Linux Desktop

Dalam sebuah siaran pers, Novell mengumumkan SUSE(R) Linux Enterprise Desktop 10 telah meraih '2007 InfoWorld Technology of the Year Award' dinobatkan sebagai "Best Linux Desktop." Menurut InfoWorld, Novell telah mengangkat distribusi Linux desktop dan memoles dengan professionalitas berikut fitur-fitur useabiliti unik yang tidak ditemukan dari vendor lain. Alhasil SUSE Linux Enterprise Desktop 10 menyediakan sejumlah alasan yang kuat kepada 'business users' untuk menjadikan Linux sebagai 'enterprise desktops' mereka.