DNS bind attacksJan 26 2012 11:35AM J. von Balzac (jhm balzac gmail com) (2 replies)
I'm seeing a lot of hosts in my named logs (I mean log files, it's not
like I am naming my poop)
...ok... silly joke hehe
So anyway, named bind is reporting a lot of denied queries of type
'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which
is to immediately block the IPs for port 53 after as few as one denied
query) - but I want to warn server admins who haven't spotted both
these queries and other denied queries.
Common sense suggests that these hosts are probably spoofed IPs. Looks
like an effective way to ddos a host: request an arbitrary DNS record
with a spoofed IP and let the server reply to the spoofed IP in
whatever way. Do that with many hosts and there is your denial of
service.
A side effect is that when you block the IP, you're blocking something
that isn't really doing anything wrong as it's a spoofed IP
But ok, I'm not too sure of this so please shoot holes in my theory or
suggest better fixes/workarounds/...
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.
like I am naming my poop)
...ok... silly joke hehe
So anyway, named bind is reporting a lot of denied queries of type
'isc.org/ANY/IN'. I'm not looking for a solution - I have one (which
is to immediately block the IPs for port 53 after as few as one denied
query) - but I want to warn server admins who haven't spotted both
these queries and other denied queries.
Common sense suggests that these hosts are probably spoofed IPs. Looks
like an effective way to ddos a host: request an arbitrary DNS record
with a spoofed IP and let the server reply to the spoofed IP in
whatever way. Do that with many hosts and there is your denial of
service.
A side effect is that when you block the IP, you're blocking something
that isn't really doing anything wrong as it's a spoofed IP
But ok, I'm not too sure of this so please shoot holes in my theory or
suggest better fixes/workarounds/...
------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate. We look at how SSL works, how it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.
http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442
f727d1
------------------------------------------------------------------------
[ reply ]