Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Is that around like 3000 compromised computers?

Nope, this could easily be done with far less. This is an amplification attack.

Due to the design of DNS and UDP it allows you to send a simple/small request to a poorly configured DNS server [one that open resolves for anybody - there are a lot out there] and pretend you are doing it from your targets IP address.

UDP is a fire and forget protocol, you send it a source address and it will reply to that address. With DNS recursion you can easily send a request which will reply to your target. The amount of data returned from these DNS servers and sent to your victim can often be a 50x larger than your initial request. The more open resolvers you find, the more damage you can do, without needing much more upload bandwidth from your host [relative]

eg:

You request from your host:

  dig ANY isc.org @x.x.x.x +edns=0 == 64bytes
Response to your victim:

  ; <<>> DiG 9.7.3 <<>> ANY isc.org @x.x.x.x
 ;; global options: +cmd
 ;; Got answer:
 ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5147
 ;; flags: qr rd ra; QUERY: 1, ANSWER: 27, AUTHORITY: 4, ADDITIONAL: 5

 ;; QUESTION SECTION:
 ;isc.org.                        IN        ANY

 ;; ANSWER SECTION:
 isc.org.                4084        IN        SOA        ns-int.isc.org. hostmaster.isc.org. 2012102700 7200 3600 24796800 3600
 isc.org.                4084        IN        A        149.20.64.42
 isc.org.                4084        IN        MX        10 mx.pao1.isc.org.
 isc.org.                4084        IN        MX        10 mx.ams1.isc.org.
 isc.org.                4084        IN        TXT        "v=spf1 a mx ip4:204.152.184.0/21 ip4:149.20.0.0/16 ip6:2001:04F8::0/32   ip6:2001:500:60::65/128 ~all"
 isc.org.                4084        IN        TXT        "$Id: isc.org,v 1.1724 2012-10-23 00:36:09 bind Exp $"
 isc.org.                4084        IN        AAAA        2001:4f8:0:2::d
 isc.org.                4084        IN        NAPTR        20 0 "S" "SIP+D2U" "" _sip._udp.isc.org.
 isc.org.                484        IN        NSEC        _kerberos.isc.org. A NS SOA MX TXT AAAA NAPTR RRSIG NSEC DNSKEY SPF
 isc.org.                4084        IN        DNSKEY        256 3 5 BQEAAAAB2F1v2HWzCCE9vNsKfk0K8vd4EBwizNT9KO6WYXj0oxEL4eOJ

 <snip>

 ;; MSG SIZE  rcvd: 3223 [bytes]
You start sending 100s of these request a second, the reply data builds up.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: