Spamhaus attacks expose huge open DNS server dangers
Denial-of-service attacks that take advantage of open DNS resolvers are not new.
As far back as in 2006, more than 1,500 organizations around the world were hit by a series of similar attacks, prompting wide concern from security experts.
Then, as now, many security experts warned that ISPs and others operating DNS servers must ensure that their systems are properly configured to prevent attacks such as the one launched against Spamhaus. The problem remains as pervasive as ever despite the warnings, experts note today.
The Open DNS Resolver Project , an effort by a group of security experts to draw attention to the issue, estimates that there are currently about 27 million DNS servers that are open resolvers. About 25 million of those pose a significant threat, according to the project's website.
According to Prince, barely 100,000 of the open resolvers were used to direct 300Gbps of traffic against the organization. "What's spooky here is that only a tiny fraction of the open resolvers were used," he said. The attackers could easily have co-opted more DNS servers, Prince noted.
"This is a situation where some configuration changes on the DNS server side can help prevent the attacks," said Alex Cox, a principal security researcher with RSA Security's FirstWatch team.
But the required changes are difficult to get without a broad collaboration among ISPs. "The problem with a DNS attack is you can't really turn your DNS servers off" without causing widespread disruption, Cox said. "Once this thing blows over it will be interesting to see how some of the folks whose infrastructure was used will respond."
The perpetrators of this week's attacks knew that Spamhaus had a good infrastructure in place to deal with denial-of-service attacks and therefore had to do something really big, said Dan Holden, director of the security and engineering response team at Arbor Networks.
Such attacks are not fully defendable but can be mitigated by ensuring that DNS servers are configured properly, he said. "The good news is that these open DNS resolvers will get a lot more visibility" following the attacks he said. "So hopefully the issue will get fixed."
Several standards are readily available to help ISPs and others operating DNS servers to configure systems to ensure they respond only to requests from their own users, said Mike Smith director of the customer security incident response team at Akamai.
DNS server operators also need to have egress filtering controls in place to ensure that the DNS traffic leaving their networks originated from inside their network, he said.
The Open DNS Resolver Project also calls on DNS server operators to consider implementing rate-limiting software to prevent the sort of traffic amplification that was used in the Spamhaus attacks.
"There are things that need to get cleaned up. That is why we need some awareness of the problem," Smith said.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- New docs show DHS was more worried about critical infrastructure flaw in '07 than it let on
- Needed: Breach detection correction
- Evan Schuman: Resurrection of Full Disclosure mailing list is great news, if you're not a cyberthief
- Cyberattacks could paralyze U.S., former defense chief warns
- Syrian Electronic Army shanghais Microsoft's Twitter account, blog
- Is French outrage against U.S. spying misplaced?
- Lawmakers seek answers on Obamacare Data Hub security
- China-based hacking group behind hundreds of attacks on U.S. companies
- How to Prepare for a Potential Syrian Counterattack on the U.S. Power Grid
- New York Times site outage caused by attack on domain registrar, company says
Read more about Cybercrime and Hacking in Computerworld's Cybercrime and Hacking Topic Center.
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Cybersecurity for Dummies eBook This book provides an in-depth examination of real-world attacks and APTs, the shortcomings of legacy security solutions, the capabilities of next-generation firewalls, and...
- Live Webcast Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- Security Vulnerabilities Associated With Having Local Administrator Privileges Viewfinity will demonstrate how removing admin rights and granularly managing privileges at the application level reduces the attack surface.
- It's not too late...Get Your Mobile Questions Answered Live! How can IT provide seamless and secure mobile communications and collaboration for all? Join this live Webcast as IDG asks an expert panel... All Cybercrime and Hacking White Papers | Webcasts