Subject: RE: [ietf-dkim] Threats Issue - Large DNS records make servers targets for spoofed source amplification attacks abuse

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 28 Feb 2006 06:13:48 -0800

> From: william(at)elan.net [mailto:[email-masked]] 

> > The only solution to this sort of thing is going to be to 
> find a way 
> > of suppressing DDoS type traffic, in particular spoofed 
> source address 
> > packets. This is not very hard for ISPs to do, if a machine is 
> > generating reams of spoofed source address data then it has been 
> > botted and should be either refused service or moved to an 
> isolation network.
> 
> You're obviously not an operations guy when you say its easy. 

Compared to the problem of dealing with spoofed source address traffic
at the other end it is easy.

> The spoofing issue is nothing new (its decades old), but it 
> obviously has not been solved. There are some applications 
> and sites that depend on being able to have their upstreams 
> accept packets from non-local nets (I can find and direct you 
> to nanog posts that described that)

There are people who think they need to do such things, such people tend
to be wrong with remarkable frequency. 

There is no excuse for a residential broadband ISP not performing source
address filtering on the traffic coming of the cable or ADSL hookup,
NONE. 

Combining network and Internetwork functions is bad security policy and
probably bad network ops. It is certainly legit for a subscriber to have
multiple connections to the Internet. That does not mean that they
either need or want the ability to route general traffic.

> Note that this arises as an issue only for ICMP and some UDP 
> protocols.
> With TCP this is not as much a problem because full TCP 
> communication would require establishing of a session which 
> requires the source to confirm the sequence # sent by the 
> destination SYN (read about 3-packet handshake, if you do not 
> know). 

You should practice being patronizing more often.

Actually there are people who do TCP spoofing as you are probably aware
from the spam world. This is used to send large volumes of spam 'from'
hijacked dialup machines. The dialup machine only does the SYN part of
the protocol, the bulk of the data is sent from a hijacked broadband
machine.

> As of this year miscreants switched to using DNS servers as 

They are professional criminals, not miscreants.

> However as I'm pointing out the recursive dns servers is only 
> one way to do it which derives from ability to poison them 
> and then cause them to reply with large response (so as to 
> use them for amplification). If dns server is not recursive, 
> but has very large dns record it can also be used for 
> amplification (slightly worse amplification factor of 1:20).
> The smart way to avoid this becoming an issue is to either 
> use TCP or to use UDP protocol with fixed and fairly small 
> response packets.

It is not our job to fix the core DNS protocol.

The amplifier attack you describe will worst case cause a doubling in
the data volume and that only if the attack machine is directing traffic
through multiple DNS servers at one time.

This is not a big enough effect to be concerned with.

_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: "william(at)elan.net" <[email-masked]>
Date: Tue, 28 Feb 2006 07:48:58 -0800 (PST)

> to be wrong with remarkable frequency.

I happened to think there are better ways to achieve the results but I 
would not go into saying that those who need spoofing capabilities right
now are wrong. In any case, you need to face the facts that many ISPs 
are not going to drop spoofed packets now even if we tell them to as this
is capability some of their business customers require. This is slightly 
better with DSL access providers but even there it is quite often allowed 
for business connections.

> the protocol, the bulk of the data is sent from a hijacked broadband

Yes, this does happen. It is actually not usually hijacked dialup machine 
but dialup connection directly bought from ISP with stolen credit card.
The entire tcp session connection is established using dialup ip address
as source, but actual packets go out from different interface - fairly 
easy to achieve actually on linux and used for legitimate purposes.

It used to be more popular for spam purposes but I think this is quite
rare now due to availability of zombies. What spammers do still use is
getting space at some carrier-neutral colo center, connecting to multiple 
providers and using one's ip address to establish the session but really 
sending data though cheaper network (typically cogent) without actively 
advertising such connectivity from outside. Considering this is totally 
legitimate way to do traffic engineering, there is nothing that can 
really be done about this practice.

> It is not our job to fix the core DNS protocol.

I'm not sure it can be fixed given nature of the problem. And its
our job to realize these limitations, especially when trying to
re-purpose and reuse the protocol.

> through multiple DNS servers at one time.

I'd really like to see where you came up with this "doubling" number 
estimate especially "if multiple DNS servers" are used.

Just so you know the current cisco.com DKIM record results in 342bytes 
message data (do "dig txt nebraska._domainkey.cisco.com") and security
of this key is may not be sufficient and many will probably use 2k ones 
in the future. The original packet request to retrieve that key was
40-50 bytes in size (only QUESTION section). My estimates is that just
one dns server with DKIM record abused by this attack should give about
8x amplification effect (if you like I can write specialized scripts and
give exact numbers for several sites). With larger record size and if more 
dns servers are present in zone files, this will increase further still.

Such 10x amplification numbers is more then good enough to make it worth
it to criminals.

-- 
William Leibzon
Elan Networks
[email-masked]