Routing Loops as Mega Amplifiers for DNS-Based DDoS Attacks

Abstract

DDoS attacks are one of the biggest threats to the modern Internet as their magnitude is constantly increasing. They are highly effective because of the amplification and reflection potential of different Internet protocols. In this paper, we show how a single DNS query triggers a response packet flood to the query source, possibly because of middleboxes located in networks with routing loops. We send DNS A requests to 3 billion routable IPv4 hosts and find 15,909 query destinations from 1,742 autonomous systems that trigger up to 46.7 million repeating responses. We perform traceroute measurements towards destination hosts that resulted in the highest amplification, locate 115 routing loops on the way, and notify corresponding network operators. Finally, we analyze two years of historical scan data and find that such "mega amplifiers" are prevalent. In the worst case, a single DNS A request triggered 655 million responses, all returned to a single host.

Unveiling the Weak Links: Exploring DNS Infrastructure Vulnerabilities and Fortifying Defenses

“…Instead, malicious URLs (and domain names) are blocked by web browsers (e.g., Chrome, Firefox) using Google Safe Browsing. The problem is raised by open (misconfigured) DNS servers that facilitate amplification reflection Distributed Denial-of-Service (DRDoS) attacks [47], [57], [66], [73], [75], [78]. Open DNS resolvers accept DNS requests from any end host, which can be misused to either target authoritative nameservers by sending an excessive number of incoming requests or, if combined with IP address spoofing, used to redirect responses to victim end-hosts.…”

A Comprehensive Review of DNS-based Distributed Reflection Denial of Service (DRDoS) Attacks: State-of-the-Art

“…As a result, legitimate users cannot access network resources and services, or access will be very slow or intermittent. This type of attack consumes the victim's bandwidth by overloading via sending a large amount of traffic to this prey [1], [9]. The volumetric attack occurs when DNS focuses on exhausting the host's available bandwidth.…”