DNS servers must be feeling like they’re stuck in a “Groundhog Day” of denial-of-service attacks. One minute they’re translating domain names into IP addresses like the good old internet traffic cops they are, and the next, they’re drowning in data requests amplified beyond recognition. Welcome to the fascinating, chaotic world of DNS reflection and amplification attacks, where even the simplest query can lead to a deluge of data.
Recently, the SANS Internet Storm Center provided some much-needed clarity on this issue in their update on DNS reflection and odd corrupted DNS requests, shedding light on how these seemingly mundane DNS queries are wreaking havoc across the digital landscape. Let’s explore the insights from their report and examine how corrupted DNS requests are turbocharging Distributed Denial of Service (DDoS) attacks. Along the way, we’ll also uncover why certain domains are particularly problematic and what network defenders can do to fight back.
Understanding DNS Reflection Attacks: The Trojan Horse of DDoS
If you’ve ever wondered how a relatively innocent DNS server could become an unwilling accomplice in a DDoS attack, buckle up. DNS reflection attacks are a cunning exploitation technique, similar to mailing a hundred pizzas to your neighbor’s house, but with far grimmer consequences. Here’s how it works in simpler terms:
- Attackers send spoofed DNS queries to open DNS resolvers, pretending that the victim is the one making the request.
- The DNS resolvers respond to the victim’s IP address with amplified data, much larger than the original query.
- Multiply this by hundreds or thousands, and you get a tsunami of unwanted data flooding the victim’s network, effectively shutting it down.
The real kicker? Most of these attacks exploit a certain type of DNS request—ANY queries—which is exactly what it sounds like. The attacker says, “Give me everything,” and the DNS server obliges, returning a boatload of information. It’s like ordering one soda at a restaurant and receiving the entire menu instead.
Amplification: More Data Than You Bargained For
Let’s break it down with numbers. The SANS Internet Storm Center report explains how attackers leverage this amplification: an ANY query can yield a response of up to 5,826 bytes, while the original query is just a measly 37 bytes. That’s an amplification factor of nearly 158x. It’s like whispering into a megaphone and shattering windows three blocks away.
The bad news? Attackers are getting creative. Domains like nlrb.gov and fnop.net have been targeted, likely because they were vulnerable to ANY query abuse. But things get even murkier with oddball domains like ncca.mil, where queries sometimes return nothing at all. Did they finally fix the problem, or is something more sinister at play? Time will tell.
The Rise of Odd and Corrupted DNS Requests: A Comedy of Errors
Just when you thought ANY queries were the peak of the madness, here come the corrupted DNS requests—mangled, malformed queries that read like gibberish to the untrained eye. According to the SANS report, these requests are often full of coding mistakes, likely crafted by attackers who weren’t paying attention (or had simply given up on quality control).
Here’s an example from the report that’ll make you scratch your head:
ANY? o^Cco. (33)
Yes, that’s a query. No, it doesn’t make sense. It was meant to ask for data from “o.co” but instead produced a monstrosity that’s one typo away from being a legitimate request. Think of it as the cyber equivalent of trying to use a fork to eat soup—it’s not going to work, but it’s going to create a mess anyway.
Why do these malformed requests matter? Because they still trigger responses from DNS servers, often responses that include invalid NSEC records. In one case, the returned data even started with a NULL byte, a digital no-no that renders the response pretty much useless. Yet, attackers are banking on the fact that these corrupted requests will confuse resolvers and amplify their attacks anyway.
ANY Queries: The Root of All DNS Amplification Evil
It’s becoming increasingly clear that ANY queries are a favorite tool in the DDoS toolbox. Why? Because they allow attackers to siphon off the maximum possible amount of data from a DNS server with the least amount of effort. Just like you wouldn’t ask for a single item at an all-you-can-eat buffet, attackers aim to get everything the DNS server can offer in one fell swoop.
Unfortunately, many DNS servers still fall for it. In fact, servers like Google Public DNS have had to implement a “Not Implemented” (NOTIMP) response to shut down ANY queries altogether. Here’s what that looks like when someone tries to query Google for ANY records:
; <<>> DiG 9.10.6 <<>> ANY dshield.org
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOTIMP, id: 27119
Translation? “We don’t play that game anymore.”
Thankfully, other DNS servers are catching on, truncating responses instead of returning the whole kit and caboodle. RFC 8492 was even introduced to allow servers to return minimal data when they receive ANY queries, a clever move that puts a cap on amplification potential.
Defensive Tactics: Stopping the DNS Amplification Beast
So, what can be done about this seemingly endless onslaught of DNS amplification and corrupted queries? The SANS Internet Storm Center has a few suggestions, and they’re not just for the faint-hearted. Defending against these attacks requires a multi-pronged approach, from tightening up DNS server configurations to outright banning certain query types. Here are some of the key tactics:
- Limit or block ANY queries: This is a no-brainer. If your DNS server doesn’t need to respond to ANY requests, don’t let it. As we’ve seen, these queries are often the main culprits in DNS amplification attacks.
- Rate limit DNS traffic: Slowing down the flood of requests can help reduce the effectiveness of DDoS attacks. Rate limiting isn’t a cure-all, but it’s a decent start.
- Deploy DNSSEC (Domain Name System Security Extensions): Although DNSSEC isn’t designed specifically to combat reflection attacks, it helps prevent certain types of DNS tampering that attackers might exploit.
- Use truncated responses for ANY queries: This can drastically reduce the size of the response sent back to an attacker, cutting the amplification factor down to size.
- Close open DNS resolvers: An open resolver is like leaving your front door unlocked in a bad neighborhood—it’s an open invitation to trouble. Closing open resolvers prevents them from being used in reflection attacks.
Case in Point: Fixing the Amplification Problem
The report from SANS also highlights that some domains have been proactive about fixing their DNS vulnerabilities. For example, domains like fnop.net no longer return full ANY query responses, instead truncating them to minimize amplification. It’s a small step, but one that can make a big difference in the ongoing fight against DNS reflection.
FAQs About DNS Reflection, Amplification, and Corrupted Queries
What is a DNS reflection attack?
A DNS reflection attack is a type of DDoS attack where attackers send spoofed DNS requests to open DNS resolvers. These resolvers, believing the victim is making the request, flood the victim’s IP address with large amounts of data, overwhelming their network.
Why are ANY queries used in these attacks?
ANY queries are favored because they return all DNS records associated with a domain. This allows attackers to generate a much larger response from a relatively small request, amplifying the attack.
What are malformed or corrupted DNS requests?
Malformed DNS requests are improperly formatted queries, often the result of sloppy coding or intentional manipulation. These queries can cause DNS resolvers to behave unpredictably, contributing to the chaos in DDoS attacks.
How can DNS reflection attacks be mitigated?
Defensive measures include blocking ANY queries, implementing rate limiting, closing open resolvers, and using DNSSEC. Truncating responses to ANY queries can also reduce the potential for amplification.
What is RFC 8492, and how does it help?
RFC 8492 allows DNS servers to truncate the response for ANY queries, preventing the server from sending large volumes of data in response to a single query. This reduces the amplification factor in potential DDoS attacks.
Conclusion: From Query to Chaos, It’s Time to Fight Back
DNS reflection and amplification attacks are a reminder that even the most basic internet protocols can be weaponized if left unchecked. But the good news is that the security community is catching on. By blocking ANY queries, tightening up DNS configurations, and closing open resolvers, we can minimize the damage these attacks cause.
The next time you type a web address into your browser, take a moment to appreciate the hardworking DNS servers out there—fending off amplified junk queries and mangled requests, all while making sure you get where you need to go. And if you manage a DNS server, well, it’s time to start battening down the hatches.
