← Back

DNS Amplification Attacks: The Magnifying Glass of DDoS

A DNS amplification attack is a type of Distributed Denial of Service (DDoS) attack that exploits the functionality of the Domain Name System (DNS) to overwhelm a target's network. It is a particularly effective method because it can amplify a small amount of malicious traffic into a massive flood of data, making it difficult to defend against.

How DNS Amplification Works

This attack operates by leveraging open DNS resolvers. These are DNS servers that are configured to respond to queries from any IP address on the internet, not just from a specific set of clients. Attackers exploit this openness in a three-step process:

  1. Spoofing the Source IP: The attacker crafts a DNS query, but instead of using their own IP address as the source, they spoof the IP address of the intended victim. This means the DNS server will see the query as coming from the victim's machine.

  2. Sending Small Queries: The attacker sends a large number of these spoofed DNS queries to many different open DNS resolvers. These queries are typically small, often just a few bytes.

  3. Receiving Large Responses: The key to the attack is that the queries are designed to elicit a very large response. For example, a query for all DNS records for a particular domain (ANY query type) can result in a response that is many times larger than the initial request. This is the amplification factor.

Because the source IP was spoofed to be the victim's, all of these large responses are sent back to the victim's network. The combined traffic from hundreds or thousands of different DNS servers can quickly overwhelm the victim's network bandwidth, causing a denial of service.

Here's a simplified look at a DNS query that can be used for amplification:

# An 'ANY' query to a public DNS resolver
dig @<open_dns_resolver_ip> <domain_name> ANY +short

This simple command, when automated and sent from a botnet with spoofed source IPs, becomes the foundation of the attack.

The Blue Team Perspective: Defense Strategies

Defending against DNS amplification attacks requires a multi-layered approach. It's a classic case where prevention is more effective than reaction.

1. Ingress Filtering

This is a crucial first line of defense implemented by Internet Service Providers (ISPs). Ingress filtering prevents packets with a spoofed source IP address from entering a network. By checking if the source IP address of a packet belongs to the network it's coming from, an ISP can block malicious traffic at the source. This is the most effective way to prevent the attack from even starting.

2. Rate Limiting and Protocol Validation

Network devices like firewalls and routers can be configured to rate-limit incoming DNS traffic. If a single IP or a subnet receives an abnormally high volume of DNS responses, the device can drop or throttle the traffic. Similarly, protocol validation can check if DNS packets are malformed or contain suspicious queries, and drop them before they can cause damage.

3. DNS Resolver Hardening

From a broader perspective, a critical defense is to fix the underlying vulnerability: the existence of open DNS resolvers. Network administrators should harden their DNS servers to only respond to queries from their authorized clients. A simple configuration change can prevent a DNS server from being used as an amplifier.

Here's an example of how to configure a BIND DNS server to only allow queries from specific subnets:

// BIND named.conf.options file
options {
    directory "/var/cache/bind";
    recursion yes;

    // Only allow queries from our internal network
    allow-recursion { 192.168.1.0/24; 10.0.0.0/8; };
    allow-query { any; };
};

In this example, allow-recursion is set to specific internal networks, effectively closing the server to outside amplification requests.

4. DDoS Mitigation Services

For organizations that are a frequent target, relying on a DDoS mitigation service is a sound strategy. These services have the capacity and specialized hardware to absorb and filter massive amounts of attack traffic, distinguishing legitimate traffic from malicious floods and allowing a business to remain online during an attack.

By understanding the mechanics of a DNS amplification attack and implementing these preventative and defensive measures, organizations can significantly reduce their risk of becoming a victim.

Conclusion

DNS amplification attack, a type of DDoS attack, works by turning open DNS resolvers into a weapon. The attacker sends a small DNS query with a spoofed source IP address (the victim's), tricking the DNS server into sending a much larger response to the victim. This "amplification" of traffic, multiplied across many DNS servers, overwhelms the victim's network, causing a denial of service. The article also provides blue team (defensive) strategies, including ingress filtering by ISPs to prevent spoofing, rate limiting and protocol validation on network devices, and the critical step of hardening DNS resolvers to prevent them from being used in attacks. It concludes by highlighting the importance of using DDoS mitigation services for comprehensive protection.

***
Note on Content Creation: This article was developed with the assistance of generative AI like Gemini or ChatGPT. While all public AI strives for accuracy and comprehensive coverage, all content is reviewed and edited by human experts at IsoSecu to ensure factual correctness, relevance, and adherence to our editorial standards.