1. DNS/RFC/5358

J. Damas (ISC), F. Neves (Resgistro.br) October 2008

https://tools.ietf.org/html/rfc5358

こういう攻撃もあるという例：

3. Problem Description https://tools.ietf.org/html/rfc5358#section-3

Because most DNS traffic is stateless by design, an attacker could start a DoS attack in the following way:

  1. The attacker starts by configuring a record on any zone he has
    • access to, normally with large RDATA and Time to Live (TTL).
  2. Taking advantage of clients on non-BCP38 networks, the attacker
    • then crafts a query using the source address of their target victim and sends it to an open recursive nameserver.
  3. Each open recursive nameserver proceeds with the resolution,
    • caches the record, and finally sends it to the target. After this first lookup, access to the authoritative nameservers is normally no longer necessary. The record will remain cached at the open recursive nameserver for the duration of the TTL, even if it's deleted from the zone.
  4. Cleanup of the zone might, depending on the implementation used
    • in the open recursive nameserver, afford a way to clean the cached record from the open recursive nameserver. This would possibly involve queries luring the open recursive nameserver to lookup information for the same name that is being used in the amplification.

Taking advantage of an open recursive nameserver that supports EDNS0 [RFC2671], the amplification factor (response packet size / query packet size) could be around 80.

With this amplification factor, a relatively small army of clients and open recursive nameservers could generate gigabits of traffic towards the victim.