<div dir="ltr">I'm curious if anyone knows the significance of that 7-byte string? They say it's common to all attack traffic, whether the query or the response, so that suggests it's the qname. But it doesn't look like a valid qname to me, so open resolvers wouldn't respond to it with any amplification. What am I missing?<div>
<br></div><div>Damian</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Oct 14, 2013 at 8:58 PM, Dobbins, Roland <span dir="ltr"><<a href="mailto:rdobbins@arbor.net" target="_blank">rdobbins@arbor.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">
<div dir="auto">
<div><br>
</div>
<div><br>
Begin forwarded message:<br>
<br>
</div>
<blockquote type="cite">
<div><b>From:</b> James Braunegg <<a href="mailto:james.braunegg@micron21.com" target="_blank">james.braunegg@micron21.com</a>><br>
<b>Date:</b> October 15, 2013 at 5:34:08 AM GMT+3<br>
<b>To:</b> "<a href="mailto:ausnog@ausnog.net" target="_blank">ausnog@ausnog.net</a>" <<a href="mailto:ausnog@ausnog.net" target="_blank">ausnog@ausnog.net</a>><br>
<b>Subject:</b> <b>[AusNOG] Layer 7 - Distrusted Source (within a single AS) Distrusted Distention - Denial of Service Attack</b><br>
<br>
</div>
</blockquote>
<div><span></span></div>
<blockquote type="cite">
<div>
<div>
<p class="MsoNormal">Dear All<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Just thought I’d share some interesting<span style>,</span> potentially frightful information with reference to DNS amplification request attacks we have observed.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We are now seeing 100’s of targeted IP addresses within the same network AS targeted by 1000’s of IP addresses (all of which are spoofed UDP packets)<span style> a network administrators nightmare.</span><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Normally we see a DDoS attacks against specific /32 IP address although it would appear the tables are turning to have a more distributed attack towards the targeted network which hosts the /32 service which is being attacked<span style>.</span><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">What we have noticed however is all the attack traffic regardless of the source, distention, targeted URL or query has a common pattern matching signature of \50\fa\00\08\00\01\20 common to every packet generated from this substantial botnet
which is frequently published on this amplification attack webpage. <a href="http://dnsamplificationattacks.blogspot.com.au/" target="_blank">
http://dnsamplificationattacks.blogspot.com.au/</a> <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This pattern is common both if you’re receiving the attack or if your network is participating in the attack, so as long as you can filter each packet based on an exact hex format you have a chance on mitigating the attack traffic.<span style><u></u><u></u></span></p>
<p class="MsoNormal"><span style><u></u> <u></u></span></p>
<p class="MsoNormal"><span style>What’s also interesting is whilst open DNS resolvers used to be the common source of DNS amplification older versions of bind are also susceptible to participate in an attack even if open resolving is turned off
when a request comes through, as BIND prior to version 9.5 allows root hint servers to be returned even when a REFUSED response is sent. You can disable this by adding `additional_from_cache no;` into BIND's configuration, which has stopped sending root hint
servers along with REFUSED status.<u></u><u></u></span></p>
<p class="MsoNormal"><span style><u></u> <u></u></span></p>
<p class="MsoNormal"><span style>Hope this information is useful, happy to discuss in more detail if you’re interested !<u></u><u></u></span></p>
<p class="MsoNormal"><span style><u></u> <u></u></span></p>
<p class="MsoNormal"><span style>Kindest Regards<u></u><u></u></span></p>
<p class="MsoNormal"><span style><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-family:"Verdana","sans-serif"">James Braunegg<br>
</span></b><b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif"">P:</span></b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif""> 1300 769 972 |
<b>M:</b> 0488 997 207 | <b>D:</b> (03) 9751 7616</span><span style="font-size:8.0pt;font-family:"Verdana","sans-serif""><u></u><u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif"">E:</span></b><span style="font-size:8.0pt;font-family:"Verdana","sans-serif"">
</span><span style><a href="mailto:james.braunegg@micron21.com" target="_blank"><span style="font-size:8.0pt;font-family:"Verdana","sans-serif"">james.braunegg@micron21.com</span></a></span><span style="font-size:8.0pt;font-family:"Verdana","sans-serif"">
| <b>ABN:</b> <a href="tel:12%20109%20977%20666" value="+12109977666" target="_blank">12 109 977 666</a> <br>
<b>W:</b> <a href="http://www.micron21.com/ip-transit" target="_blank"><span style>www.micron21.com/ip-transit</span></a></span><span style="font-size:8.0pt;font-family:"Verdana","sans-serif"">
</span><span style="font-size:8.0pt;font-family:"Verdana","sans-serif""> <b>T:</b> @micron21<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana","sans-serif""><br>
<img border="0" width="250" height="39" alt="Description: Description: Description: Description: M21.jpg"><br>
</span><span lang="EN-AU" style="font-size:8.0pt;font-family:"Verdana","sans-serif"">This message is intended for the addressee named above. It may contain privileged or confidential information. If you are not the intended recipient of this message
you must not use, copy, distribute or disclose it to anyone other than the addressee. If you have received this message in error please return the message to the sender by replying to it and then delete the message from your computer.</span><span style="font-size:8.0pt;font-family:"Verdana","sans-serif""><u></u><u></u></span></p>
<p class="MsoNormal"><span style><u></u> <u></u></span></p>
<p class="MsoNormal"><span style><u></u> <u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>AusNOG mailing list</span><br>
<span><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a></span><br>
<span><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a></span><br>
</div>
</blockquote>
</div>
</div></div><br>_______________________________________________<br>
dns-operations mailing list<br>
<a href="mailto:dns-operations@lists.dns-oarc.net">dns-operations@lists.dns-oarc.net</a><br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations
dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-operations<br>
dns-jobs</a> mailing list<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-jobs" target="_blank">https://lists.dns-oarc.net/mailman/listinfo/dns-jobs</a><br></blockquote></div><br></div>