2

Is it possible to DOS DNS by creating custom dns zones with lots of text records in them so that the size of the DNS zone is in the order for example 100 Gigabyes, and then query all the dns records from the zone from the internet and thus possibly filling up the disk of dns caching servers?

Bind9 has a max-cache-size directive but isnt that for the whole server and only the memory?

  • 1
    I'd say if your DNS server is able to accept unauthenticated creation of DNS zones, you have much bigger problems than a DOS attack. – AJ Henderson Mar 14 '14 at 13:21
  • @AJHenderson, I think he's suggesting to create DNS zones on his evil.com server and then query them via victim.com's caching nameservers. So the zone creation isn't unauthenticated. – gowenfawr Mar 14 '14 at 13:47
2

I'll use BIND as the example server software here, for the obvious reason.

1) You can't fill up the disk of dns caching servers. Cache is in memory, not on disk. The only way the cache goes to disk is if the administrator goes in and triggers a dump to disk by hand (and that dumped version isn't used by the cache server, it's just there for the administrator to debug with).

2) You can DOS - or at least impact the performance of - caching DNS servers by filling up the cache. Consider this post - granted, it's 10 years old, but BIND has always been remarkably predictive of BIND.

3) I'm not even sure AXFR gets cached, or that cacheing nameservers will handle AXFR queries. For example, you can query this example domain directly:

$ dig axfr @ns12.zoneedit.com zonetransfer.me

; <<>> DiG 9.9.3-rpz2+rl.156.01-P2 <<>> axfr @ns12.zoneedit.com zonetransfer.me
; (1 server found)
;; global options: +cmd
zonetransfer.me.        7200    IN      SOA     ns16.zoneedit.com. soacontact.zoneedit.com. 2013064418 2400 360 1209600 300
zonetransfer.me.        7200    IN      NS      ns16.zoneedit.com.
zonetransfer.me.        7200    IN      NS      ns12.zoneedit.com.
zonetransfer.me.        7200    IN      A       217.147.180.162

However, you can't do the same using the well-known BBN caching nameservers as an intermediary. Watch as the AXFR fails, but an NS query works fine:

$ dig axfr @4.2.2.1 zonetransfer.me
;; communications error to 4.2.2.1#53: end of file
$ dig ns @4.2.2.1 zonetransfer.me

; <<>> DiG 9.9.3-rpz2+rl.156.01-P2 <<>> ns @4.2.2.1 zonetransfer.me
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 49741
...
;; ANSWER SECTION:
zonetransfer.me.        7200    IN      NS      ns16.zoneedit.com.
zonetransfer.me.        7200    IN      NS      ns12.zoneedit.com.

That being said, I couldn't find a good reference that would explain what BIND's caching server will or will not do, so it's hard to make a sweeping statement.

4) Bottom line: Sure, you could DOS a DNS server, but I'm not sure your "large AXFR" method is likely to do it. And any such DOS would be temporary (in memory), not systemic. A more likely method would be to create a ginormous number of A records with large TTLs and query them all individually. (gowen's rule #022: By definition, any Service is susceptible to Denial of Service.)

  • Thanks for your answer and clarifying that Bind cache is only stored in RAM. I meant by very large number of known TXT records and querying them individually rather than AFXR/zone transfer. – Christian Mar 14 '14 at 13:57
  • My mistake! When you said "from the zone" my mind translated it the wrong way. – gowenfawr Mar 14 '14 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.