Is Your DNS Server A Weapon?

The Syrian Electronic Army: 9 Things We Know

Distributed denial of service (DDoS) attackers aim to either overload the CPU or clog networks with irrelevant traffic. These attackers often control large numbers of computers that are part of botnets and instruct them to make repeated requests to a website, overloading networks and processing power. However, security teams can fight back by blocking connections from botnet IP addresses to protect bandwidth and ignoring repeat requests to the same URL to protect processing power.

As a result, to conduct a successful denial of service attack, attackers must amplify the effect of the resources under their control. One way that can happen: DNS amplification.

DNS requests are an ideal mechanism by which attackers can increase the amount of traffic thrown at their victims, while hiding the origin of the attack. Many DNS servers on the Internet are configured as "open resolvers" that accept and respond to DNS queries from anywhere on the Internet. Sending very small requests to these servers can result in large replies that can be directed toward a victim's systems.

For example, the short query to retrieve DNS information for the domain InformationWeek.com:

dig ANY informationweek.com

Results in a large amount of information being returned:

;; ANSWER SECTION:

informationweek.com. 11334 IN NS ns2.ubm-us.net.

informationweek.com. 11334 IN NS ns1.ubm-us.net.

informationweek.com. 11334 IN NS ns3.ubm-us.net.

informationweek.com. 11334 IN SOA ns1.ubm-us.net. dnsadmin.ubm-us.net. 201310100 1800 900 1209600 1800

informationweek.com. 11334 IN A 192.155.48.18

informationweek.com. 11334 IN AAAA 2620:103::192:155:48:18

informationweek.com. 11334 IN MX 10 mailhost.ubm-us.net.

informationweek.com. 11334 IN TXT "v=spf1 mx include:spf.ubm-us.net -all"

informationweek.com. 11334 IN TXT "google-site-verification=doCdAIQ4FJ3yo-047WoLHDdjRLjR_A9qHK-PIIlYLmU"

;; Query time: 0 msec

;; SERVER: 10.30.40.15#53(10.30.40.15)

;; WHEN: Thu Oct 17 03:31:00 2013

;; MSG SIZE rcvd: 346

In this case, sending a 45-byte DNS request packet results in 346 bytes of DNS information being returned, amplifying the amount of returned data compared with the size of the request by a factor of 7.7.

Including other information in DNS records, such as cryptographic keys to comply with DNSSEC or DKIM standards, enlarges the response from the DNS server. A query for any DNS information for the domain whitehouse.gov results in 2877 bytes of information being returned, an amplification factor of 71.9 compared with the request.

DNS queries are sent as UDP packets, meaning that the source of the request is not verified by a handshake in the same way as TCP, allowing the origin to be falsified. Members of a botnet can spoof DNS requests to appear to have come from a victim's IP address, causing DNS replies to be sent to that address rather than to the address of the request originator. Hence, a small botnet can cause a large amount of data to be sent to the victim's network; a large botnet can deluge a victim with an enormous amount of data.

In essence, the attack is similar to using many Post-It notes to request entire Yellow Pages directories to be sent to a mailing address, rendering victims unable to perform their usual activities due to the sheer volume of delivered directories.

Secure Your DNS

Amplified DNS-based denial of service attacks are particularly difficult to defend against, because such attacks consist of large volumes of legitimate data sent from legitimate sources. These attacks are possible due to the large number of DNS servers configured to be open resolvers, responding to DNS requests without regard to the origin of the request.

The Open Resolver Project has identified 28 million DNS servers that pose a significant threat of being used in such an attack. Companies should ensure that their DNS servers are not among those capable of contributing to a denial of service attack by taking the following steps:

-- Limit recursion to only authorized clients, such as trusted networks and known DNS servers.

-- Identify and reject packets with spoofed IP addresses by verifying the IP address of their sources.

-- Limit the response rate of DNS servers so that they can't flood networks.

-- Limit the size of outbound DNS messages so that suspiciously large DNS replies are blocked.

Further, check the status of your DNS servers by scanning them from a remote network with nmap, replacing x.x.x.x with the IP address of your server:

nmap -sU -p 53 -P0 --script "dns-recursion" x.x.x.x

This uses the dns-recursion script included in default nmap installations to send UDP packets to port 53 and report if the ability to perform recursive queries is detected. A reply containing the phrase:

"Recursion appears to be enabled"

denotes that a server might be able to be abused

Ready, Set, Defend

Consider the ramifications of such an attack against your systems now, and prepare a defense-in-depth strategy. Distribute highly visible public-facing systems, such as websites, across the world via a content delivery network with enough bandwidth to withstand attack. Work with your providers to ensure that attacks against corporate networks are detected and blocked as far upstream as possible. It is also vital to detect traffic anomalies as soon as possible -- attacks might be preceded by transient peaks in traffic as attackers check that their systems are operational before launching a full assault. Automated detection of anomalous traffic can alert operators to take action and execute a prepared remediation plan.

Attackers are adept at exploiting Internet protocols that were designed for a benign world. To defend against these attacks, do your best to harden your systems. And when attacks occur, ensure that you're able to call on more resources and expertise than are available to the attackers.