New-age cyber-attack inflicts major damage with modest means
Ladyboydolls.com and the new DDoS
A Matter of Time
The attacks being tracked by Jackson have been accompanied by more traditional distributed denial of service (DDoS) attacks generated by botnets. They bear the hallmarks of a commercial DDoS application known as BlackEnergy (PDF), leading Jackson to believe it's only a matter of time before the technique gets folded into the package.
What's more, an increasing number of sites over the past couple weeks have been subjected to the attack. For now, they tend to be underground operations such as those cranking out pharmaceutical spam, but Jackson expects that to change.
"When the bot writers integrate this and use it as a value add, then we'll see it in the mainstream," he said.
The only way to prevent the attack is for DNS administrators to ensure their servers are configured to answer upward referrals only to authorized zones within their domain. While some DNS software, such as DJBDNS, does this by default, plenty of other other programs don't. Various versions of BIND, by far the most widely used DNS program, by default return queries for the root servers. (Instructions for changing this behavior in BIND are available here).
DNS software from Microsoft and others can also be used by attackers as DNS amplifiers out of the box, Jackson says. (Readers who know how to change this default behavior for other packages are invited to leave a comment or contact me using this link).
Another possible fix, ISPrime's Rosenthal said, is using firewalls built into FreeBSD, Linux, and Windows. But Jackson says this solution is far from ideal. That's because it would require the blacklisting of hundreds of thousands of legitimate DNS servers. Instead, Jackson is leaning toward the use of special signatures based on the open-source intrusion prevention system known as Snort.
But even some of the more feasible remedies may create problems, warns Baylor University's Vaughn, who says the sudden squelching of DNS responses to the queries could create collateral damage as the requests are repeated over and over.
"Everything we do has a cost, and unfortunately, this is one of those things where there might be some debate about what to do," he said. "There's going to have to be by protocol some sort of response." ®
Sponsored: Are DLP and DTP still an issue?