DNS problem linked to DDoS attacks gets worse

IDG News Service - Internet security experts say that misconfigured DSL and cable modems are worsening a well-known problem with the Internet's DNS (domain name system), making it easier for hackers to launch distributed denial-of-service (DDoS) attacks against their victims.

According to research set to be released in the next few days, part of the problem is blamed on the growing number of consumer devices on the Internet that are configured to accept DNS queries from anywhere, what networking experts call an "open recursive" or "open resolver" system. As more consumers demand broadband Internet, service providers are rolling out modems configured this way to their customers said Cricket Liu, vice president of architecture with Infoblox, the DNS appliance company that sponsored the research. "The two leading culprits we found were Telefonica and France Telecom," he said.

In fact, the percentage of DNS systems on the Internet that are configured this way has jumped from around 50% in 2007, to nearly 80% this year, according to Liu.

Though he hasn't seen the Infoblox data, Georgia Tech Researcher David Dagon agreed that open recursive systems are on the rise, in part because of "the increase in home network appliances that allow multiple computers on the Internet."

"Almost all ISPs distribute a home DSL/cable device," he said in an e-mail interview. "Many of the devices have built-in DNS servers. These can sometimes ship in 'open by default' states."

Because modems configured as open recursive servers will answer DNS queries from anyone on the Internet, they can be used in what's known as a DNS amplification attack.

In this attack, hackers send spoofed DNS query messages to the recursive server, tricking it into replying to a victim's computer. If the bad guys know what they're doing, they can send a small 50-byte message to a system that will respond by sending the victim as much as 4 kilobytes of data. By barraging several DNS servers with these spoofed queries, attackers can overwhelm their victims and effectively knock them offline.

DNS experts have known about the open recursive configuration problem for years, so it's surprising that the numbers are jumping up.

However, according to Dagon, a more important issue is the fact that many of these devices do not include patches for a widely publicized DNS flaw discovered by researcher Dan Kaminsky last year. That flaw could be used to trick the owners of these devices into using Internet servers controlled by hackers without ever realizing that they've been duped.

Infoblox estimates that 10% of the open recursive servers on the Internet have not been patched.

The Infoblox survey was conducted by The Measurement Factory, which gets its data by scanning about 5% of the IP addresses on the Internet. The data will be posted here in the next few days.

According to Measurement Factory President Duane Wessels, DNS amplification attacks do occur, but they're not the most common form of DDoS attack. "Those of us that track these and are aware of it tend to be a little bit surprised that we don't see more attacks that use open resolvers," he said. "It's kind of a puzzle."

Wessels believes that the move toward the next-generation IPv6 standard may be inadvertently contributing to the problem. Some of the modems are configured to use DNS server software called Trick or Tread Daemon (TOTd) -- which converts addresses between IPv4 and IPv6 formats. Often this software is configured as an open resolver, Wessels said.