DNS amplification - root cause

Overview

This article is about the root cause of DNS amplification. Why is it possible today? Why Internet could be killed in a matter of seconds? And the main question - how could we stop this attack from happening.

Amplification attack

This attack is a part of big DDoS family attacks - Distributed Denial of Service. This means, that there are few host over the Internet, whose actions lead to the service disruption.
Usually amplification attacks are aimed at bandwidth exhaustion.

There are few protocols that could be used to organize an amplification attack: DNS, NTP, Chargen, SNMP, ICMP and some more.

The lethal beauty of amplification attack is in its simplicity: by sending the small request (with spoofed address, of course) you get few times bigger response. The scheme below illustrates DNS amplification attack.

As you can see, an attacker sends 36 bytes requests to the server and the victim receives nearly 4 KBytes response (amplification factor is 50!). ANY-queries are the most frequent, when we are talking about DNS amplification.

The pic above illustrates amplification attack in real world.

One of the biggest DDoS attacks that took place in 2013 aimed at Spamhaus was performed using DNS amplification. It was told, that ~30 000 DNS servers was used to generate this 300 Gbit/s attack.

EDNS0

In 1991 RFC2671 was published. It was the first set of extensions for DNS protocol also known as EDNS0.
This set proposed to extend DNS to allow for new flags and response codes, and to provide support for longer responses. Before that the longest response possible over UDP was 512 bytes.

Longer responses made DNS amplification attacks feasible.

What should I do?

As you can see, DNS amplification is possible, because of the possibility of sending a packet with a spoofed address and because of poorly configured DNS servers.
There are number of techniques that could help to protect your DNS server from beign used for amplification attack.

Ingress filtering

Ingress filtering is a technique used by many ISPs to prevent source address spoofing. The idea is to check, whether the client is sending the traffic with the allocated address or not. The best current practises are documented by the IETF in year 2000 in BCP38 and then in 2004 in BCP84 (in case of multihomed networks).

DNS config

Recursive requests
If your DNS server is reachable from the Internet, then you shoud disable or limit recursive queries. An attacker could use or create a zone, that could be used for amplification attack. Disabling or limiting recursive queries would make the use of this vector of attack impossible.

Limit max UDP size
Sometimes it is good to set the maximum size of a response, that could be sent via UDP. By EDNS0 it is 4096. You may set it to 512 bytes, thus making your DNS server not so attractive for an attacker.

Rate limit
There are few options:
1) Limit requests by source IP - not very good, IPv6 is almost here, but still, there are lot's of users behind NAT. Means you could drop some legitimate requests.
2) Limit requests by zone or domain name - that might work, but still remember about legitimate requests.
3) Limit responses by destination IP - as DNS amplification is based on sending a crafted packet with spoofed address, this technique may work pretty well and again make your DNS server not so attractive for an attacker.