Subject: Re: DNS Server DoS Attacks

From: "D. J. Bernstein" <[email-masked]>
Date: 23 Nov 2002 06:16:46 -0000

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

The DNS protocol should be augmented with a separate protocol for
distributing (signed) copies of the root zone (in a sensible format)
through USENET, mailing lists, etc. ISPs can and should run local root
servers.

I agree with the idea of caching root zone data for a very long time.
The root-zone protocol should promise that every piece of data will last
for a month.

Effects on load: Everybody will receive the entire zone, rather than
just the parts they need. On the other hand, any sensible format would
be much smaller than DNS packet format. More importantly, the data will
be cached much more effectively than it is with the current root-zone
protocol. Most importantly, the load will be very widely distributed.

Side benefit: It will be easy to expand to hundreds of .com servers. Of
course, the root servers could pack more than 20 .com server addresses
into a 512-byte UDP packet with the current protocol (if they drop the
silly one-name-one-address notion), and nobody would complain if the
root servers selected those addresses randomly from a much larger pool;
but distributing the root zone lets ISPs pick nearby .com servers.

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "John M. Brown" <[email-masked]>
Date: Sat, 23 Nov 2002 00:47:04 -0700

packet forwarding engines won't tell the difference between 
a good query and a bad query without serious penalty to the
PFE performance.

your idea would break caching and cause more flotsam to hang 
around in various systems. 

personally, I like having things cache age out of the DNS
during an attack.  lets me change the A RR for a victim to
a different IP.  Useful for those scripts that don't update
their cached IP for the victim name.

three things will help provide better strength against DDOS
attacks.

a)  properly managed anycast of the root infrastructure.

b)  securing the edge of the net.  remove the zombie hosts
    and they can't be used as a tool.

c)  signing the root zone, more for layer 8 reasons than others.

when providers decide to start applying various tools to improve
security on the edge (ergo clients) things will become better.

John M. Brown, CEO
Chagres Technologies, Inc
Le Geek

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Alec H. Peterson
> Sent: Friday, November 22, 2002 5:38 PM
> To: [email-masked]
> Subject: DNS Server DoS Attacks
> 
> 
> These attacks seem to be on the rise.  There were the 
> well-publicized ones 
> on the root servers a few weeks ago, and yesterday UltraDNS 
> was hit with 
> one.  It occurs to me that these attacks have the potential 
> to completely 
> shut down the DNS system if they are structured properly.  I 
> have a thought 
> on how to make the system more resiliant to authoritative 
> servers getting 
> hammered, and was interested in some thoughts on it.
> 
> My thought is to add another TTL to DNS responses, similar to the SOA 
> maximum parameter.  The current TTL would be similar to the 
> SOA minimum. 
> This would still allow for records to expire in a reasonable 
> amount of 
> time, but it would also allow for DNS responses to be 
> answered in the event 
> that servers in the hierarchy are unreachable for some 
> reason.  It occurs 
> to me that it is possible to retrofit existing DNS servers to 
> have a static 
> maximum timeout without any protocol modifications.
> 
> Anyway, the way I see it since DNS already has a caching 
> infrastructure 
> built in it makes sense to take extra advantage of that 
> infrastructure when 
> things are under attack.
> 
> Alec
> 
> --
> Alec H. Peterson -- [email-masked]
> Chief Technology Officer
> Catbird Networks, http://www.catbird.com
> 
> --
> to unsubscribe send a message to 
> [email-masked] with the word 'unsubscribe' 
> in a single line as the message text body.

---

From: "Alec H. Peterson" <[email-masked]>
Date: Sat, 23 Nov 2002 07:48:52 -0700

> a good query and a bad query without serious penalty to the

I don't think I understand, what does my suggestion have to do with packet 
forwarding engines distinguishing between good and bad queries?

> around in various systems.

Well yes, it would break the current caching model by changing it.

> their cached IP for the victim name.

But if your authoritative DNS servers aren't even reachable to have the 
cache get re-populated then what good is it to have the cache get aged?  My 
proposal doesn't change the current cache aging system, you can still have 
a 10 minute TTL and have an authoritative server re-query after the 
original 10 minutes has expired.  This just _allows_ caching nameservers to 
keep stuff for longer if it is not possible to re-populate the cache due to 
unreachable nameservers.

> a)  properly managed anycast of the root infrastructure.

Agreed that anycast does help.

>     and they can't be used as a tool.

Agreed.

> c)  signing the root zone, more for layer 8 reasons than others.

I fail to see how signing the root zone would keep somebody from flooding 
me with packets.

> security on the edge (ergo clients) things will become better.

No argument.

Alec

---

From: Randy Bush <[email-masked]>
Date: Sat, 23 Nov 2002 08:07:37 -0800

perhaps folk should review steve bellovin's nanog talk (dc?) on
pushback.

randy