5

So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think).

Based on recent events (the attack to Dyn's DNS service) I was wondering:

Could a DNS Amplification be used to DOS a DNS Server? [DNS Server A] attacks [DNS Server B] which attacks [DNS Server C] and so on...

Would it not work because of the different protocols? (TCP and UDP)

(Sorry if I am posting on the wrong forum or if I am missing something really simple)

Improve this question
4
  • Yes to both, I am exaggerating (although that if performed on several DNS companies it could be really bad) and I am talking about the Dyn's DNS service.
    – Ricardo Ribeiro
    Oct 25, 2016 at 22:26
  • In anticipation of a better answer from someone else, I will go ahead and share what I can now. Basically the answer is Yes. DNS Amplification is useful when the initial attacker does not have enough bandwidth for the required attack. DNS Amplification can be used for Bandwidth Exhaustion even if no DNS server is run by the victim. (However, in Dyn's case, this was probably server load and not an attack on the bandwidth.) I would assume that DNS Amplification has several other DNS-specific attacks on server load, but I don't think you would see an extended chain (A attacks B attacks C, etc.)
    – 700 Software
    Oct 25, 2016 at 23:16
  • 1
    Thanks for the tips, I have edited my question.If a DNS Server is receiving lots of data from DNS queries results, besides the high bandwidth, wouldn't the server load get higher trying to handle all those requests with lots of data?
    – Ricardo Ribeiro
    Oct 25, 2016 at 23:26
  • Yes. There are two types of DoS attacks. Bandwidth Exhaustion, and Server (or Router) Load. In the latter case, the offending IPs can sometimes be blocked in the router to prevent it from causing much load. In the former case, the ISP would have to block them upstream, or you could by more bandwidth. In either case, DDoS simply means the attack is coming from multiple sources, so that simply blocking them by IP is quite difficult.
    – 700 Software
    Oct 26, 2016 at 0:06

1 Answer 1

Reset to default
2

So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think).

DNS Flood - Sending a lot (lot means really lot; may be millions or even more) of queries (mainly random queries) to the DNS server with the intention of bringing down the services is a DNS Flood.
As DNS queries are mainly of UDP in nature (except DNSSEC or Zone Transfer or few others) and spoofing UDP packets is not a rocket science; so we can consider DNS Flood can be achieved easily.
There are multiple methods available for the DNS administrator to protect the resources from flood attack like- Rate Limiting, running servers in anycast mode and many other.

DNS Amplification - In this, attacker use to flood the victim machine/bandwidth through the DNS answers, which are replied by the OpenResolvers.
In nutshell, attacker use to send the random queries to the millions of OpenResolver, with the source IP of the victim (as packet is udp, so spoofing an ip address is not a challenge). OpenResolver in turn replies and answer is sent to the victim.

Could a DNS Amplification be used to DOS a DNS Server? [DNS Server A] attacks [DNS Server B] which attacks [DNS Server C] and so on...

Would it not work because of the different protocols? (TCP and UDP)

As explained above, In a DNS Amplification attack,

  • Attacker [having ip address 1.1.1.1], use to send DNS queries [having ip address 2.2.2.2]
  • In DNS packet, Src IP address is of victim's address [lets say 3.3.3.3]
  • DNS Server on receiving the query [having ip 2.2.2.2] will reply to victim [3.3.3.3]
  • Although victim [3.3.3.3] didn't ask for any dns record from [2.2.2.2] but it is getting the packets

Now, suppose a case where millions of OpenResolvers are sending DNS responses to the victim. This attack will have a potential to choke the victim's bandwidth along with choking the memory and processing capabilities.

Achieving a chain type of attack through DNS Amplification is difficult to achieve and chain length can be of 2 to 3 nodes only AND this too will not be able to generate to lot of amplification to bring down the service.

Improve this answer
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .