Providing Minimal-Sized Responses to DNS Queries That Have QTYPE=ANY

Abley, Joe; Guðmundsson, Ólafur; Majkowski, Marek; Hunt, Evan

doi:10.17487/rfc8482

Cited by 10 publications

(15 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Dropping full responses to 'ANY' queries through RFC 8482 [5] helps reduce the DDoS problem, as we show in Section VI. We fear, when the RFC gains more adoption, domains created for DDoS attacks will shift their efforts to a single record type to obtain a size near equal to their 'ANY' response size.…”

Section: Operational Considerationsmentioning

confidence: 98%

“…Since we attempt to estimate the size of a complete 'ANY' response, we next filtered out invalid and incomplete responses. This includes resolvers employing RFC 8482 [5] as a defense mechanism as well as failing or malformed responses (a return code other than 'NOERROR', a missing 'SOA' record, or responses that had the truncate flag set). Lastly, we also filtered out partial responses by comparing the set of records returned for a domain over all resolvers.…”

Section: B Validating the Estimationsmentioning

confidence: 99%

“…The DNS community has proposed several countermeasures to mitigate the amplification potential of DNS. A countermeasure that has received quite some attention is the proposal to minimize responses to 'ANY' queries, as detailed in RFC 8482 [5]. The prominent provider Cloudflare explains that this will help in multiple areas, including reducing traffic, but chiefly against DDoS attacks [6].…”

Section: Introductionmentioning

confidence: 99%

“…• propose and validate a method to estimate the response size to 'ANY' queries, based on large-scale active DNS measurement data covering over 65% of the global namespace; • compare and rank the expected response sizes of domains observed in attacks to domains from our dataset, to investigate if DNS-based DDoS attacks can become worse in the future; • perform a quantitative analysis of the consequence of limiting 'ANY' queries as proposed in RFC 8482 [5].…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

ANYway: Measuring the Amplification DDoS Potential of Domains

Toorn

Krupp

Jonker

et al. 2021

2021 17th International Conference on Network and Service Management (CNSM)

View full text Add to dashboard Cite

DDoS attacks threaten Internet security and stability, with attacks reaching the Tbps range. A popular approach involves DNS-based reflection and amplification, a type of attack in which a domain name, known to return a large answer, is queried using spoofed requests. Do the chosen names offer the largest amplification, however, or have we yet to see the full amplification potential? And while operational countermeasures are proposed, chiefly limiting responses to 'ANY' queries, up to what point will these countermeasures be effective?In this paper we make three main contributions. First, we propose and validate a scalable method to estimate the amplification potential of a domain name, based on the expected ANY response size. Second, we create estimates for hundreds of millions of domain names and rank them by their amplification potential. By comparing the overall ranking to the set of domains observed in actual attacks in honeypot data, we show whether attackers are using the most-potent domains for their attacks, or if we may expect larger attacks in the future. Finally, we evaluate the effectiveness of blocking ANY queries, as proposed by the IETF, to limit DNS-based DDoS attacks, by estimating the decrease in attack volume when switching from ANY to other query types.Our results show that by blocking ANY, the response size of domains observed in attacks can be reduced by 57%, and the size of most-potent domains decreases by 69%. However, we also show that dropping ANY is not an absolute solution to DNSbased DDoS, as a small but potent portion of domains remain leading to an expected response size of over 2,048 bytes to queries other than ANY.

show abstract

Section: Operational Considerationsmentioning

confidence: 98%

Section: B Validating the Estimationsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

ANYway: Measuring the Amplification DDoS Potential of Domains

Toorn

Krupp

Jonker

et al. 2021

2021 17th International Conference on Network and Service Management (CNSM)

View full text Add to dashboard Cite

show abstract

“…Taken together, our contributions help enterprises address their current blind spot in monitoring their DNS assets and the threats they are exposed to. The passive analysis we propose is automated, risk-free, and particularly beneficial to 1 Security Information and Event Management. large organizations with numerous assets managed by diverse personnel.…”

Section: Introductionmentioning

confidence: 99%

Analyzing Enterprise DNS Traffic to Classify Assets and Track Cyber-Health

Lyu,

Gharakheili,

Russell

et al. 2022

Preprint

View full text Add to dashboard Cite

The Domain Name System (DNS) is a critical service that enables domain names to be converted to IP addresses (or vice versa); consequently, it is generally permitted through enterprise security systems (e.g., firewalls) with little restriction. This has exposed organizational networks to DDoS, exfiltration, and reflection attacks, inflicting significant financial and reputational damage. Large organizations with loosely federated IT departments (e.g., Universities and Research Institutes) often do not even fully aware of all their DNS assets and vulnerabilities, let alone the attack surface they expose to the outside world.In this paper, we address the "DNS blind spot" by developing methods to passively analyze live DNS traffic, identify organizational DNS assets, and monitor their health on a continuous basis. Our contributions are threefold. First, we perform a comprehensive analysis of all DNS traffic in two large organizations (a University Campus and a Government Research Institute) for over a month, and identify key behavioral profiles for various asset types such as recursive resolvers, authoritative name servers, and mixed DNS servers. Second, we develop an unsupervised clustering method that classifies enterprise DNS assets using the behavioral attributes identified, and demonstrate that our method successfully classifies over 100 DNS assets across the two organizations. Third, our method continuously tracks various health metrics across the organizational DNS assets and identifies several instances of improper configuration, data exfiltration, DDoS, and reflection attacks. We believe the passive analysis methods in this paper can help enterprises monitor organizational DNS health in an automated and risk-free manner.

show abstract