Geekly Articles each Day
📜 ⬆️ ⬇️

Open recursive DNS server. Part 2



Almost 4 months ago I opened my recursive DNS server for all Internet users (see previous article ). The accumulated amount of data at the first stage of the test was large enough, for its visualization, I drove the data into the database and built dynamic changing graphs and a map. The recorded video can be viewed under the cut. The result was quite interesting, so I didn’t completely shut down the DNS server, but limited myself to including zones (used for attacks) in RPZ lists (what is RPZ can be found in this article ). “Relaxing” on “small” attacks (no more than 100 requests per second), I did not block the answers for the two DNS zones and received the first abuse report. Abuse-report was sent to the data center of my provider from the "robot". The load on his network from my server was small and periodically reached 100 requests per second. Given the fact that millions of open resolvers could be used, the maximum load on his network could be significant. Abuse-report and motivated me to go to the second part of the test. Turning off the open recursive DNS and continued to monitor the behavior of the attackers.

Visualization of the attack described in the first article :


')
Test environment description

When writing the last article, all data was collected and processed almost in manual mode. It was long, tedious, and sometimes the results had to be checked. Since I’m lazy enough, I like to automate processes and analyze data, I asked myself to create a small system for reporting and analyzing incoming logs from a DNS server in near real time mode (if this is interesting, I can describe it in a separate article). All graphs and tables used in this article were generated using jqPlot, jqGrid and Google Maps. I use the Infoblox virtual device as a DNS server, but its syslog format is similar to bind.

Attacks

During testing, my server was used to conduct DrDoS attacks (Amplification + Reflection), as well as attempts were made to implement cache poisoning. According to some queries, it was obvious that the DGA (Domain Generation Algorithm) mechanism is used, possibly for cache poisoning, possibly for communicating with control centers (since these domains were used only for attacks) or when attacking with phantom domains.

After turning off the recursive server, the parasitic load decreased, but did not disappear completely.

The peak load on the “open” server reached 3 thousand requests per second and on average kept about 100 requests per second; on a closed server, the maximum load decreased to 20 requests per second with rare peaks to 100 requests (the rate limit is set to 300 requests per minute with the possibility of growth up to 1000).



As can be seen in the graph below, the companies in the United States suffered the most from the actions of the attackers.



Analyzing the number of requests sent to the network of each company can indirectly help to identify victims and possible infected networks. For example, the China Telecom network is likely infected, and the client of Rostelecom was attacked. The table below shows the information to organizations, the number of IP addresses and the number of requests processed. Information about companies was obtained using the whois service.

A countryCompanyNumber of requestsIP count
United StatesSoftLayer Technologies Inc.396520236
United StatesSingleHop, Inc.261798727
United StatesPSINet, Inc.199446122
FranceOVH SAS1051080304
United kingdomHosting Services Inc938367four
Germany1 & 1 Internet AG76102012
United StatesPrivateSystems Networks748641four
Russian FederationOJSC Rostelecom Ticket 09-39331, RISS 15440, UrF687028one
United StatesTime Warner Cable Internet LLC6712111568
CanadaOVH Hosting, Inc.592920213
United StatesAkamai Technologies, Inc.1763274410
ChinaChina Telecom51565207
United StatesAT & T Internet Services27502854


DrDOS attack

The domains listed in the table below were used for the attack. Domain freeinfosys.com appeared after the "closing" of the recursive server. Which may mean that someone uses outdated databases that are rarely checked.
To determine if your server is being attacked or used to conduct attacks, it is enough to analyze which domains and how often you applied with the ANY + E request.

DomainRequestFlagNumber of requests
webpanel.skANY+ E14962032
oggr.ruANY+ E8300693
energystar.govANY+ E6676350
doleta.govANY+ E6326853
067.czANY+ E2463053
sema.czANY+ E1251206
GUESSINFOSYS.COMANY+ E690320
jerusalem.netfirms.comANY+ E587534
paypal.deANY+ E454756
nlhosting.nlANY+ E414113
freeinfosys.comANY+ E352233
krasti.usANY+ E333806
doc.govANY+ E259248
svist21.czANY+ E231946
wradish.comANY+ E117294


When using ANY + E, all information on the zone is requested and the EDNS functionality is activated in order to get the maximum possible UDP packet size. A list of the 10 most frequent requests and their flags is given in the table below.

RequestFlagsNumber of requests
ANY+ E43500439
A-ED17339
ANY+11932
A-9853
A-EDC8956
AAAA-EDC4749
AAAA-ED4467
ANY-2289
A+ E1899
Rrsig+ E1124


Cache Poisoning, Random domain attack and DGA

During the operation of the DNS server, a small number of attacks on cache poisoning were detected. In the statistics of the Infoblox DNS server, it was stated that the answers were received with the wrong ports and query ID, but, unfortunately, no log files were found for analysis.

In addition, suspicious requests of the form were detected:


It is possible that these records are partly related to detected attempts to cache the cache, trying to conduct an attack using phantom domains (the authoritative server does not respond and thus the outbound connection pool is clogged) or the work of “unknown animals” (malware) trying to contact the control center.

findings

Source: https://habr.com/ru/post/246123/

More articles:


All Articles