4

What is Open Resolver Project and how does it give a solution for DNS reflection attack?

I also read that Open Resolver Project follows BCP38. What is BCP38?

5

The Open Resolver Projects tries to find recursive DNS servers which have no access lists to restrict which clients can use the nameserver. Nameservers like these can be used for DNS amplification attacks because they can be mislead using spoofed IP addresses for DNS queries. The attacker forges the source of the query to the address of its victim. The answer (which can be quite large, especially when DNSSEC is involved) will be sent to the spoofed address. When a large number of these spoofed requests are done simultaneously from many networks, the amount of traffic caused by answers will be large, possibly large enough to cause a Distributed Denial of Service Attack (DDoS).

BCP38 is a best practice in network engineering which can be used to stop spoofed requests within the network of the attacker. It basically says that no traffic should leave a network coming from IP addresses which are not assigned to that network. This can be done using techniques like access lists or reverse path filtering (RPF).

Open Resolvers are just one (very effective) way to exploit networks which do not implement BCP38 for performing DDoS'es. Other services are used as well, for example NTP seems to be quite popular in the last few weeks. Allowing queries on resolvers only from trusted source addresses (closing down the resolves so to say) is a good thing, but it's just stopping one type of attacks. Implementing BCP38 throughout a network is a much more effective solution, since it stops many more types of attacks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.