DNS Amplification
DNS amplification is a reflected DDoS attack in which the attacker uses open DNS resolvers to multiply the traffic aimed at a victim. The attacker sends relatively small DNS queries but forges the victim's address as the source.
Term
description · examples · notesDNS amplification is a reflected DDoS attack in which the attacker uses open DNS resolvers to multiply the traffic aimed at a victim. The attacker sends relatively small DNS queries but forges the victim's address as the source.
Description
The DNS resolvers then send their answers to the victim, not to the attacker. If the answer is much larger than the query, the attacker gains amplification: a little of their own traffic produces far more reflected traffic. With a large number of open resolvers involved, the target can be buried very quickly.
This attack shows why badly configured infrastructure endangers more than its owner. An open resolver that answers everybody on the internet can become a weapon in an attack on somebody else. The victim sees a flood of DNS answers it never asked for.
Examples
- The attacker uses thousands of open DNS resolvers that send large answers at the victim's public site.
- DNS amplification is combined with other reflected vectors, such as NTP or CLDAP, to increase the pressure.
- A provider sees an enormous number of DNS answers heading to a customer who sent no matching queries.
Notes
- A DNS server answering the whole internet with no need to is not merely a bad configuration but part of somebody else's problem.
- BCP38 source address filtering and closing open resolvers reduce the chance that the infrastructure is turned against others.
Techniques
carried out with 2Techniques used to carry it out. Select one to open its page.
Defenses
countered by 4How it is defended against. Select one to open its page.