Why would home routers accept incoming DNS traffic?

Question

I stumbled upon an interesting paper (PDF Link) where researchers found out that more than 58% of the DNS open resolvers that are blamed in DDoS attacks are in fact home routers distributed by ISPs to customer. The paper goes on to find out the reason for the odd (anomalous) behavior where these routers respond to DNS queries with the wrong source port (not udp 53), and found that the problem is probably caused by a faulty NAT rule.

I think that research is interesting, but what I cannot understand is that why would manufacturers make such home routers accept any kind of traffic initiated from the wild internet? I know some of them have the option to open configuration page from WAN thus listening on port 80 or 443 (or whatever custom port you set), but what justification can be thought of for opening up a service like DNS to the outside world? And if that was just a side effect for something those manufacturers tried to accomplish, what would it possibly be? Could it be some kind of a backdoor not configured well? and to do what? Or am I missing something here?!

Answer 1

SoHo routers generally provide IP masquerading (NAT). This means that they need to provide a DHCP service and (because DNS uses UDP, and hence cannot be used across IP masquerading) also need to provide a DNS server.

(OK that's a simplification, and these are requirements arising primarily from usability which could be solved by more elaborate technical solutions - but end-users don't like technical stuff)

So given that these devices need to provide these services, the question then becomes why are these services exposed on the internet side? The short answer is that it takes additional effort to restrict the services to the inside network. While adding such a restriction to, say, a Linux or Cisco box is trivial, a lot of these devices use proprietary operating systems written without any consideraton of the security implications (hence we end up with devices containing hard-coded admin backdoors and other such horrors).

Even where adding the restriction is trivial, it still means an extra R&D cost. If you're used to configuring network devices you may scoff at this - but one step above the manufacturers you might consider simply incompetent are those who will only implement features which they have thoroughly tested - and done properly those costs can escalate rather quickly.

The great buying public are starting to become aware of security as a desirable property in computer equipment, but in the absence of an effective, cheap and well published standard for device security, they have no basis for making an informed decision about the quality of a device. Hence it's a market for lemons.

While I agree with Jeff that cost is a major factor in the chain of causality, I would not say it is the root cause of the problem here.