DNS Threats part 4: Denial of Service.
Denial of Service attacks, also known as overload or blocking attacks, are as old as the Internet itself. Over the years, they have evolved to resemble legitimate traffic to avoid detection of anti-DDoS countermeasures.
Countless techniques have been used to bring a targeted host or network down. Most of them have been rather crude and, using large botnets, have had quite some success in the past. As the countermeasures for DDoS attacks have improved over the years, identifying and mitigating them as they emerge, the threat actors have had to evolve their techniques. Even though botnets can be leased by the hour and countless DDoS attacks are launched every minute, the implemented DDoS protection mechanisms are doing a great job. This doesn’t mean that the threat of DDoS attacks is going away.
High-end DDoS countermeasures use traffic pattern anomaly detection and AI to distinguish real traffic from attacks. In this seemingly endless game of cat and mouse, threat actors push themselves to make their DDoS attacks appear as normal, legitimate traffic. That is why we see new and sophisticated attacks to fool or circumvent these countermeasures.
As stated earlier, denial-of-service attacks aim to disrupt or stop hosts or services from working by overloading them. Targeting an organisation’s DNS service makes lots of sense. If an attacker is able to take the DNS service out, all the services that the DNS provides are affected. This article will focus on DoS attacks against the DNS itself and DoS attacks where the attacker uses the DNS as a participant in the attacks.
The underlying problem
In this article series we have discussed the many shortcomings of the DNS protocol, especially the use of the User Datagram Protocol (UDP), which has contributed to many vulnerabilities. However, the DNS protocol was designed for speed, so the UDP protocol had to be used, and today, many of the obvious (and less obvious) weaknesses have been fixed.
The UDP protocol is designed to be connectionless, meaning the sending party will not know if the packet reaches its destination unless a response is received. One drawback of a connectionless protocol is that it completely lacks source control, making spoofing (impersonating) an IP address other than the sender’s own relatively easy.
Source address spoofing is a common technique used by hackers to mask their own source address when launching attacks. Source address spoofing could have been prevented long ago if the service providers had implemented filters in all their edge routers. But that is history and we have to deal with the hand we have.
DNS reflection/amplification attack
A DNS reflection/amplification attack is a clever asymmetric attack in which the DNS is used as a reflector and amplifies the attack by responding to a DNS query request.
The basics of this attack is straightforward. A specially crafted DNS query packet is sent to a DNS resolver. The query packet is spoofed with the victim’s sender IP address. The query response, quite possibly a factor of 50 times the query size, will be sent to the victim. Multiply this and the attacker can use a minimal set of hosts to continuously send queries to various DNS resolvers, eventually choking the victim’s bandwidth or buffers, whichever comes first.
This attack can use both DNS resolvers and authoritative DNS servers, as long as they are authoritative for the domain in the query.
The attack does not have to use the same query. Instead, it can use queries for many domains, making the attack harder to identify.
Flooding attacks
Flooding attacks directed at the DNS service come in many shapes. A flood attack is a symmetric attack aiming to exhaust the targeted DNS service. It could be directed at authoritative servers for a selected domain or at certain resolver services.
Symmetric attacks largely depend on brute force rather than finesse. The brute-force is usually achieved using large botnets and spoofed source addresses. Flooding attacks are symmetric, in contrast to asymmetric attacks like the amplification attack above. By directing the attack to a specific set of name servers serving a specific domain, they are usually moderately successful. Successful flooding attacks can cause severe collateral damage, such as the attack on DYN in 2016.
On October 21, 2016, the DNS service provider DYN was hit by three consecutive DDoS attacks launched from a botnet of IoT devices. These attacks caused service disruptions on DYN’s DNS infrastructure, which in turn led to service outages and disruptions on many high-profile platforms like Amazon, Spotify, Netflix, PayPal, CNN and others. The magnitude of this attack caused the US Department of Homeland Security to launch an investigation.
DNS Flood attacks
Using a botnet, the attacker sends large numbers of DNS queries directed to a DNS infrastructure (or a resolver service) at an extremely high packet rate, causing the DNS server to exhaust its resources and possibly crash. Each query appears to originate from different source addresses, which makes it appear somewhat legitimate.
DNS Water Torture attacks
This attack is recognised by many different names, like the NXDOMAIN attack or the Pseudorandom Subdomain (PRSD) attack. The common denominator is that they all send queries for domain names that don’t exist, generating NXDOMAIN responses. There are examples where open DNS resolvers and authoritative servers have been targeted. It pretty much depends on the query content of the attack.
Domain Generation Algorithms appear to have been used in these kinds of attacks. Previously, they were known as malware and used through C2 channels (see DNS Threats part 3: DNS tunnelling), but they are now used to generate bogus subdomain names for these types of attacks. With the use of botnets, a DNS water torture attack can generate well over 4 million queries per second, which is a lot of queries for any DNS server.
Since every query in these attacks has different domain names, a resolver cannot respond from its cache, forcing it to send the query to the authoritative DNS server.
Phantom Domain attack
The phantom domain attack targets DNS resolvers. The attacker registers a set of fake domains and sets them up on its own DNS servers. The authoritative DNS servers are configured to be very slow, sometimes unresponsive, causing the resolver to tie up system resources while waiting for the slow responses and retry sending the query. With enough queries, the resolver’s internal resources are exhausted and it will stop resolving legitimate queries.
Mitigations
There are a few steps to take to mitigate the effect of Denial of service attacks.
Response Rate Limiting can be configured in the most authoritative DNS software, making sure packets are dropped when under attack. This will not prevent the attack itself, but it can protect the DNS server from crashing and possibly causing longer-lasting problems.
The use of anycast DNS is placed on different AS worldwide. With the help of BGP, traffic can be rerouted to better distribute the traffic load to different servers.
Make sure your ISP have DDoS protection activated (most already have these in place and fight DDoS attacks daily without your knowledge).
Conclusions
Throughout this article series, DNS Threats parts 1 to 4, we have covered some of the most common and best-known attacks against the DNS infrastructure.
Some attacks are more or less obsolete today, but threat actors relentlessly search for the next security hole to exploit. Some attacks are reinventions of older attacks, but with a twist or a new and fresh angle.
What is abundantly clear is that you can’t protect against them all, but with every mitigation step you take to protect your DNS, you’ll be a little bit less vulnerable.