

Planned DDOS campaign against DNS is meant to highlight piracy legislation issues




The Pastebin describes:




DNS Server
[Image Source: Renjus Blog]






Sources: PasteBin, NeoWin

Comments     Threshold


DNS Proxies
By drlumen on 3/28/2012 3:52:23 AM , Rating: 2
Correct me if I'm wrong (flame if you must) but that goes against all I was tought and read about how the DNS name system works.

I was told and read that various ISP's and others keep their own servers for DNS lookups. If there is a request for a site that has not been visited then the request keeps going up the chain with the last resort being the actual root name servers. This was also the explanation for the DNS change propagation delay as each proxy had to get the new IP for the new or changed domain name/IP.

If that is true, wouldn't their attack and planned outage only affect new or changed domains that are still within the propagation delay or obscure, rarely requested sites?

RE: DNS Proxies
By probedb on 3/28/2012 4:35:43 AM , Rating: 2
Yep :)

So my ISP or OpenDNS can't update their DNS for a week, big deal, I'm pretty sure most sites I visit don't change their IP addresses every 4 minutes.

RE: DNS Proxies
By karielash on 3/28/2012 2:51:34 PM , Rating: 2
Each record they hold has a TTL associated with it, the record governs how long the recursive server holds it not the other way around so your ISP would not last weeks....

TTL can vary between 5 minutes and a day (for the majority of records). We use 1 to 4 hours depending on the function of the server. So, after that period of time the recursive server asks the next upstream server for a refresh if the record is requested and so on up to the root servers. A lower level server could override that setting but it could potentially set up some very interesting results where an IP/Domain changes quickly (not unusual to have some 300 second records where DR is a concern).

The last time someone seriously tried to take out the root servers was about 4 or 5 years ago, they managed to take down six out of thirteen servers (it was actually two attackers where the attacks coincided), two were actually taken off-line. The DNS system never blinked and very few people noticed, taking out all thirteen servers would be a significant task, and although I am not saying it could not be done... it would be tough.

You would also have to maintain the attack for a prolonged period of time to keep the downed servers supressed while you take down the remaining servers, although at some point the normal traffic from the downed servers would cause a snowball effect on the remaining servers. Be interesting to see at what point that occurred.

