The far side of DNS amplification

Abstract

In this paper, we shed new light on the DNS amplification ecosystem, by studying complementary data sources, bolstered by orthogonal methodologies. First, we introduce a passive attack detection method for the Internet core, i.e., at Internet eXchange Points (IXPs). Surprisingly, IXPs and honeypots observe mostly disjoint sets of attacks: 96% of IXP-inferred attacks were invisible to a sizable honeypot platform. Second, we assess the effectiveness of observed DNS attacks by studying IXP traces jointly with diverse data from independent measurement infrastructures. We find that attackers efficiently detect new reflectors and purposefully rotate between them. At the same time, we reveal that attackers are a small step away from bringing about significantly higher amplification factors (14×). Third, we identify and fingerprint a major attack entity by studying patterns in attack traces. We show that this entity dominates the DNS amplification ecosystem by carrying out 59% of the attacks, and provide an in-depth analysis of its behavior over time. Finally, our results reveal that operators of various .gov names do not adhere to DNSSEC key rollover best practices, which exacerbates amplification potential. We can verifiably connect this operational behavior to misuses and attacker decision-making. CCS CONCEPTS• Security and privacy → Denial-of-service attacks; • Networks → Naming and addressing; Public Internet.

A Matter of Degree: Characterizing the Amplification Power of Open DNS Resolvers

“…Reports of DDoS attacks in the news suggest that attackers increasingly use DNSSEC-signed domains in amplification attacks [14]. This is supported by observations using DDoS honeypots [23] as well as in a recent work that studies R&A attacks using IXP traces [31]. Whether or not an open resolver supports DNSSEC is thus a factor that influences its usability for amplification from an attacker's point of view.…”

“…Nawrocki et al [31] studied the behavior of attackers in terms of which sets of open DNS resolvers they misuse in attacks. Their results show that attackers efficiently detect new resolvers and steadily rotate between them.…”

SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using Honeypots

“…Recent research observes this for different honeypot deployments, which show very diverging event sets with incomplete pictures of attacks. Two independent studies show small overlaps of only 4% [23] and 8.18% [24] between UDP amplification attacks observed at common honeypots and different vantage points (i.e., other honeypot platforms and IXPs), challenging previous assumptions and claims of convergence. Furthermore, analyses based on the large HPI platform show that convergence differs by protocol and that a general approach to high attack visibility (i.e., 99%) is hard to achieve, e.g., RIP measurements require 60 sensors and other protocols ≈150 sensors [16].…”

“…They conclude that the CCC platform captures 85.1%-96.6% of all attacks [14]. Other work derives that 5 CCC sensors monitor > 99.5% of the DNS victims [23].…”

“…We observe continuous activity (scan or attacks) for all but one faulty sensor for NTP and LDAP, why we conclude that these services were run throughout the whole measurement period. We now reproduce the honeypot convergence based on a near-optimal sensor selection, analogous to prior work [12], [23]. We sort the sensors by the number of victims and perform a greedy selection, i.e., we select the sensors with the most unique victims first.…”