DNS employs a variety of mechanisms to guarantee availability, protect security, and enhance reliability. In this paper, however, we reveal that these inherent beneficial mechanisms, including timeout, query aggregation, and response fast-returning, can be transformed into malicious attack vectors. We propose a new practical and powerful pulsing DoS attack, dubbed the DNSBomb attack. DNSBomb exploits multiple widely-implemented DNS mechanisms to accumulate DNS queries that are sent at a low rate, amplify queries into large-sized responses, and concentrate all DNS responses into a short, high-volume periodic pulsing burst to simultaneously overwhelm target systems. Through an extensive evaluation on 10 mainstream DNS software, 46 public DNS services, and around 1.8M open DNS resolvers, we demonstrate all DNS resolvers could be exploited to conduct more practical-and-powerful DNSBomb attacks than previous pulsing DoS attacks. Small-scale experiments show the peak pulse magnitude can approach 8.7Gb/s and the bandwidth amplification factor could exceed 20,000x. Our controlled attacks cause complete packet loss or service degradation on both stateless and stateful connections (TCP, UDP, and QUIC). In addition, we present effective mitigation solutions with detailed evaluations. We have responsibly reported our findings to all affected vendors, and received acknowledgement from 24 of them, which are patching their software using our solutions, such as BIND, Unbound, PowerDNS, and Knot. 10 CVE-IDs are assigned.
DNSBomb is a new practical and powerful pulsing DoS attack exploiting DNS queries and responses.
We concluded that ANY SYSTEM or MECHANISM, which can aggregate “things”, could be exploited to construct the pulsing DoS traffic, such as DNS and CDN.
Please join us to find more if you can! It is very interesting.
DNS炸弹: https://dnsbomb.net/
漏洞编号 (11)
Industry-wide: CVE-2024-33655
分享
分享于GeekCon 2023(极棒国际安全极客大赛亚军)
分享于DNS OARC 43
新闻报道
40+科技媒体报道,如The Hacker News, Cyber Security News, and dns-operation
Apple News: News
Blackhat Ethical Hacking News: News
CSDN News: News
Cyber Security News: News
CyberSecurity Help News: News
DDoS Attack News: News
Daily Dev News: News
FireXCore News: News
Freebuf News: News
GBHackers News: News
GamingDeputyNews: News
Gixtools News: News
Hack Dojo News: News
HackPlayers News: News
Hacker News: News
IMDb News: News
Itts at News: News
Lawfare Media News: News
Malware News: News
Medium News: News
Meterpreter News: News
NetManageit News: News
OWASP News: News
Owlysec News: News
Poddtoppen News: News
Quantribaomat News: News
Reddit News: News
Redware News: News
Risky Biz News: News
SC Media News: News
SOCRadar News: News
Security Online News: News
SecurityLab News: News
The Hacker News: News
Threads News: News
dns-operation: Discussion
iHeart News: News
unSafe News: News
安全客: News
每日安全动态推送: News