Summary: This content discusses a new type of DoS attack called DNSBomb, which exploits DNS mechanisms to overwhelm target systems with a high-volume burst of queries and responses.
Threat Actor: DNSBomb | DNSBomb
Victim: Any system that uses DNS services
Key Point :
- DNSBomb is a practical and powerful pulsing DoS attack that exploits DNS mechanisms.
- It accumulates DNS queries sent at a low rate, amplifies them into large-sized responses, and concentrates all responses into a short, high-volume periodic burst.
- This attack can overwhelm target systems and cause disruption or denial of service.
- All DNS resolvers could potentially be exploited to conduct the DNSBomb attack.
DNSBomb is a new practical and powerful pulsing DoS attack exploiting DNS queries and responses.
DNS employs a variety of mechanisms to guarantee availability, protect security, and enhance reliability. In this paper, however, we reveal that these inherent beneficial mechanisms, including timeout, query aggregation, and response fast-returning, can be transformed into malicious attack vectors. We propose a new practical and powerful pulsing DoS attack, dubbed the DNSBomb attack. DNSBomb exploits multiple widely-implemented DNS mechanisms to accumulate DNS queries that are sent at a low rate, amplify queries into large-sized responses, and concentrate all DNS responses into a short, high-volume periodic pulsing burst to simultaneously overwhelm target systems. Through an extensive evaluation on 10 mainstream DNS software, 46 public DNS services, and around 1.8M open DNS resolvers, we demonstrate all DNS resolvers could be exploited to conduct more practical-and-powerful DNSBomb attacks than previous pulsing DoS atttacks. Small-scale experiments show the peak pulse magnitude can approach 8.7Gb/s and the bandwidth amplification factor could exceed 20,000x. Our controlled attacks cause complete packet loss or service degradation on both stateless and stateful connections (TCP, UDP, and QUIC). In addition, we present effective mitigation solutions with detailed evaluations. We have responsibly reported our findings to all affected vendors, and received acknowledgement from 24 of them, which are patching their software using our solutions, such as BIND, Unbound, PowerDNS, and Knot. 10 CVE-IDs are assigned.
We concluded that ANY SYSTEM or MECHANISM, which can aggregate “things”, could be exploited to construct the pulsing DoS traffic, such as DNS and CDN.
Please join us to find more if you can! It is very interesting.
Source: https://dnsbomb.net
“An interesting youtube video that may be related to the article above”