(2018) DNS Unchained: Amplified Application-Layer DoS Attacks Against DNS Authoritatives.
|
Text
2018-raid.pdf Download (358kB) | Preview |
Abstract
We present DNS Unchained, a new application-layer DoS attack against core DNS infrastructure that for the first time uses amplification. To achieve an attack amplification of 8.51, we carefully chain CNAME records and force resolvers to perform deep name resolutions — effectively overloading a target authoritative name server with valid requests. We identify 178508 potential amplifiers, of which 74.3% can be abused in such an attack due to the way they cache records with low Time-to-Live values. In essence, this allows a single modern consumer uplink to downgrade availability of large DNS setups. To tackle this new threat, we conclude with an overview of countermeasures and suggestions for DNS servers to limit the impact of DNS chaining attacks.
| Item Type: | Conference or Workshop Item (A Paper) (Paper) |
|---|---|
| Divisions: | Christian Rossow (System Security Group, SysSec) |
| Conference: | RAID The International Symposium on Research in Attacks, Intrusions and Defenses (was International Symposium on Recent Advances in Intrusion Detection) |
| Depositing User: | Jonas Bushart |
| Date Deposited: | 02 Jul 2018 09:16 |
| Last Modified: | 12 Aug 2020 14:05 |
| Primary Research Area: | NRA3: Threat Detection and Defenses |
| URI: | https://publications.cispa.saarland/id/eprint/2624 |
Actions
Actions (login required)
 |
View Item |