Dark Side of the DNS Force
summary
Claims that DNS-based attacks now scale by exploiting massive domain growth from 300 million to over 2 billion and spikes to 5 billion, reusing techniques from the 300 Gbps Spamhaus amplification event and a random subdomain weapon that generates unique FQDNs like 01mp5u89.arkhamnetwork.org to overload authoritative and cache servers. Demonstrated tools combine timestamps, multiple random levels, and mixed constant/random tokens to evade detection; one case fires ~200 million unique queries at a nameserver. Mitigations (drop long strings, rate limit per source) work partially but cause false positives and operational harm.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 1:26DNS basics and function
- 3:56DNS amplification attacks
- 8:12Subdomain attack overview
- 13:24Subdomain attack analysis
- 17:35Mitigation and conclusion
- 21:01Questions and answers
related talks
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
26mMisuse of DNS, the Second Most Used Protocol
47mDNS On Fire
23mTsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection
37mAnatomy of a DDoS
28mDarwin & Protocols
16mDNS FLaRE: A Flush-Reload Attack on DNS Forwarders