My understanding is that a DNS Amplification attack involves sending a DNS resolver a bunch of requests with a spoofed sender address, which is the victim's. The DNS responds to this IP address with a whole ton of info. Where is the distributed nature that makes this DDoS and not DoS? I could see it being DDoS if the attacker used multiple DNS resolvers simultaneously, but the linked article doesn't make it sound like that's the case.
-
1Examples may involve the usage of one DNS resolver, but in reality many DNS resolvers are used at the same time. Given the fact that there are only just over 4 billion possible IP (v4) addresses, many of which are already reserved, and the fact that these DNS servers use the same port number, it is possible to do a port scan of the entire Internet for vulnerable DNS resolvers in the IPv4 address space within a very short amount of time. This makes DDoS amplification very trivial to accomplish, and most likely the reason why distributed is implied.– Jonathan GrayCommented Dec 13, 2015 at 13:54
Add a comment
|
1 Answer
From the resource you cite:
A misconfigured Domain Name System (DNS) server can be exploited to participate in a distributed denial of service (DDoS) attack.
From my understanding this means, that the distributed nature of the attack is only given if multiple servers are involved. "participate" is not really used when the affected server is the only one involved in the attack.
answered Dec 13, 2015 at 12:18
-
From this question it sounds as if a single "misconfigured" DNS resolver would be enough to attack someone security.stackexchange.com/questions/93820/… ...so is DNS amplification attack always a DDoS attack? Commented Dec 13, 2015 at 12:44
-
1@Celeritas: If you have a powerful DNS server and a weak target then it might be enough and then it would of course not be a distributed attack. Commented Dec 13, 2015 at 13:16