All Questions
30 questions
0
votes
1
answer
1k
views
Is using route 53 from AWS sufficient for DDOS protection on DNS level, or do you need to combine it with other AWS products
We have been targeted by DNS DDOS attacks. We have now migrated to AWS Route53 as these DNS servers are more resilient.
Is using AWS Route 53 enough to have basic DDOS protection? Or is it necessary ...
- 101
1
vote
0
answers
97
views
Opencart website getting request from random subdomains (DDoS)
We have an Opencart 3.0.3 website which is getting DDoSed, we then migrated it to AWS and noticed the same thing happening, we blocked access from all other countries except US & Canada. For admin ...
-2
votes
1
answer
2k
views
What is the difference between DNS flood attack and UDP flood attack?
As title says, what is the difference between DNS flood attack and UDP flood attack?
Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
- 1
2
votes
1
answer
2k
views
Difference between DNS flood attack and DNS amplifier attack [duplicate]
I am trying to understand DNS flood and DNS amplifier attack. I have read the definition and am still confused, could you give me an example of each attack or tell me the differences between them?
It ...
- 21
2
votes
1
answer
579
views
DNS flood vs DNS Amplification attack: How is one considered a network/transport layer attack and the other a application layer attack?
I am reading a survey on DDoS attacks and they describe how these attacks can be classified by either Network/Transport level attacks and Application level attacks. In their examples, they classify ...
- 71
1
vote
1
answer
607
views
Server get flooded by Avast Secure DNS
My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
- 121
1
vote
1
answer
2k
views
How bad it would be? If hackers managed to take down all 13 Root DNS servers at the same time? [closed]
Would such huge DDoS attack can cause any economical damage? How severe this DDoS attack would be, if all 13 Root DNS servers got successfully DDoSed/flooded and taken out? Would any websites even ...
user140032
5
votes
1
answer
930
views
DNS Flood using DNS Amplification?
So, a DNS Flood is when you DDOS a DNS Server, and a DNS Amplification is when you use the DNS Server to execute a DOS attack (I think).
Based on recent events (the attack to Dyn's DNS service) I was ...
- 161
6
votes
3
answers
566
views
Did the October 21, 2016 DDoS attack on Dyn's DNS service cause Bandwidth Exhausion?
A recent attack on Dyn's DNS services affected several major websites last Friday, Oct 21, 2016. I would be interested to know if this was Bandwidth Exhaustion, or if it was mainly load on the server ...
- 14k
53
votes
6
answers
8k
views
Why don't browser DNS caches mitigate DDOS attacks on DNS providers?
Why are the recent DDoS attack against DNS provider Dyn, and other similar attacks successful? Sure a DDoS attack can bring an entity down, and if that entity controls DNS servers then queries to ...
- 650
5
votes
1
answer
671
views
How to access sites whose DNS server is under attack?
As many of you noticed, last night's DDoS attack against Dyn.com made many major services unavailable, including Twitter and Spotify. Spending one Friday evening without Twitter was enough and I want ...
- 151
4
votes
2
answers
305
views
Why would attacking a DNS server have the affects it did?
I'm somewhat confused as to the technical details of the Oct. 21 DDoS. Dyn is a company, which according to wikipedia
is an Internet performance management company, offering products to
monitor, ...
- 10.2k
8
votes
3
answers
1k
views
Why was October 2016 Dyn attack limited to East Coast?
Maps on the Internet showed that the focus of the Dyn DDoS attack was on the East Coast of the US. But why?
My DNS provider is not on the East Coast and I am located in Colorado. My DNS is 8.8.8.8 (...
- 1,575
1
vote
1
answer
259
views
Why is a DNS Amplification attack considered a DDoS attack?
My understanding is that a DNS Amplification attack involves sending a DNS resolver a bunch of requests with a spoofed sender address, which is the victim's. The DNS responds to this IP address with a ...
- 10.2k
4
votes
1
answer
6k
views
Is it possible to force client use TCP instead UDP for DNS queries?
Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
- 641
12
votes
1
answer
25k
views
dns reflection attack vs dns amplification attack
Over the past few weeks I have heard discussions about a DNS reflection attack and a DNS amplification attack.
Is there truly a difference between the two or are people just using 2 different names ...
- 239
15
votes
3
answers
2k
views
External websites in logs [duplicate]
I have a website, let's call it www.good.com.
I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site ...
- 253
2
votes
1
answer
766
views
Root/Naked domain and DDOS
Some services like Github has DDOS mitigation measures for their root/naked domain, but not other subdomain(s).
What so special about the root domain concerning the DDOS attacks?
[1] http://...
- 273
4
votes
2
answers
6k
views
Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks
Hope someone can clarify.
As I understand, in a DNS DDos Amplification attacks
Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server.
The ...
- 141
2
votes
1
answer
874
views
DNS zone size overload?
Is it possible to DOS DNS by creating custom dns zones with lots of text records in them so that the size of the DNS zone is in the order for example 100 Gigabyes, and then query all the dns records ...
- 265
6
votes
1
answer
3k
views
What is Open Resolver Project and how does it solve DNS reflection attacks?
What is Open Resolver Project and how does it give a solution for DNS reflection attack?
I also read that Open Resolver Project follows BCP38. What is BCP38?
- 63
8
votes
6
answers
13k
views
Why can't we block DNS Amplification attack by blocking UDP packets or DNS response packet?
I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports.
If the all the DNS response go to a Authoritative Nameserver(victim)...
- 777
18
votes
3
answers
11k
views
DNS Amplification DDOS attack
During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
- 531
17
votes
7
answers
2k
views
Would it be possible to overload a large part of the internet, and if so then how?
Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the former....
- 273
10
votes
3
answers
34k
views
How can I identify open DNS resolvers in my network?
This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running ...
- 655
19
votes
4
answers
917
views
Global Blackout is a myth?
In order to shut the Internet down, anonymous claimed that putting-down the
13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, ...
- 2,612
3
votes
2
answers
4k
views
DDoS Protection for DNS providers
Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
- 5,419
24
votes
6
answers
5k
views
Why do DDoS attacks cost a fortune to stop?
I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions:
Is this because they try to keep the servers accessible to real site ...
- 2,978
8
votes
2
answers
12k
views
How can I detect/withstand DNS amplification attack?
I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...
- 183
6
votes
3
answers
25k
views
What is the Akamai Name Server I see for some big companies?
I have played with DNS a lot lately, and I have found that some big companies' web sites use the Akamai NS as the Name Server for their WWW servers, for example:
$>nslookup
> www.redhat.com
...
- 1,119