Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- A Windows DNS server will provide the full list of DNS root hints when queried for a domain that does not exist.
- These full list of DNS root hints can be used as an amplification factor in carrying out DDoS attacks against other sites as we have seen with these particular hosts.
- For example, a properly configured DNS server will return the following when queried for a non-existent domain:
- ++++++++++++++++++++++++++++++++++++++++
- # dig @xx.xx.xx.xx sshdfkjshdfkjhsdfjksdfkweuqweudskjsdkjweoifqoir.com
- ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> @xx.xx.xx.xx sshdfkjshdfkjhsdfjksdfkweuqweudskjsdkjweoifqoir.com
- ; (1 server found)
- ;; global options: +cmd
- ;; Got answer:
- ;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 61907
- ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
- ;; WARNING: recursion requested but not available
- ;; QUESTION SECTION:
- ;sshdfkjshdfkjhsdfjksdfkweuqweudskjsdkjweoifqoir.com. IN A
- ;; Query time: 17 msec
- ;; SERVER: xx.xx.xx.xx#53(xx.xx.xx.xx)
- ;; WHEN: Wed Aug 10 12:53:24 2016
- ;; MSG SIZE rcvd: 69
- +++++++++++++++++++++++++++++++++++++++++++++++++++++
- Note the message size of the returned data was 69 bytes
- Here is the output of a Windows DNS server that returns the DNS root hints:
- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
- dig @yy.yy.yy.yy sshdfkjshdfkjhsdfjksdfkweuqweudskjsdkjweoifqoir.com
- ; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> @yy.yy.yy.yy sshdfkjshdfkjhsdfjksdfkweuqweudskjsdkjweoifqoir.com
- ; (1 server found)
- ;; global options: +cmd
- ;; Got answer:
- ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9652
- ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 13, ADDITIONAL: 1
- ;; WARNING: recursion requested but not available
- ;; QUESTION SECTION:
- ;sshdfkjshdfkjhsdfjksdfkweuqweudskjsdkjweoifqoir.com. IN A
- ;; AUTHORITY SECTION:
- . 3600 IN NS g.root-servers.net.
- . 3600 IN NS h.root-servers.net.
- . 3600 IN NS i.root-servers.net.
- . 3600 IN NS j.root-servers.net.
- . 3600 IN NS k.root-servers.net.
- . 3600 IN NS l.root-servers.net.
- . 3600 IN NS m.root-servers.net.
- . 3600 IN NS a.root-servers.net.
- . 3600 IN NS b.root-servers.net.
- . 3600 IN NS c.root-servers.net.
- . 3600 IN NS d.root-servers.net.
- . 3600 IN NS e.root-servers.net.
- . 3600 IN NS f.root-servers.net.
- ;; ADDITIONAL SECTION:
- g.root-servers.net. 3600 IN A 192.112.36.4
- ;; Query time: 23 msec
- ;; SERVER: yy.yy.yy.yy#53(yy.yy.yy.yy)
- ;; WHEN: Wed Aug 10 13:01:22 2016
- ;; MSG SIZE rcvd: 500
- ++++++++++++++++++++++++++++++++++++++++++++++++++++++
- Note the message size of the returned data was 500 bytes
- For a properly configured Windows DNS server that does NOT provide open recursion, there is no reason to send back DNS root hints for a non-existent domain.
- In order to configure a Windows DNS server to stop providing these root hints, please perform the following:
- Rename the 'root hints cache file' to prevent reference to the root zones being used for DNS amplification attacks:
- * Open the folder %systemroot%\system32\dns and rename cache.dns to cache.dns.orig
- * Once these modifications are complete, you must restart the DNS service.
- Reference: https://kb.iweb.com/entries/22545136-Guide-to-DNS-Open-Recursion-Amplification-Issues
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
