bk99.de entertain the web since 1997

bk99.de
Hostblogger · DDoSCurated

DDoS against a public DNS blacklist

Summary

Manuel Schmitt reports on a DDoS attack on ix.dnsbl.manitu.net and then considers a list of permitted query networks. ix.dnsbl.manitu.net was hit by a DDoS attack in June 2007. Bert Ungerer and Manuel discussed operating on a whitelist basis.

Ideas

  • DNS-based blocklists are themselves attractive targets for the spammers they list.
  • A query whitelist reduces the attack surface but limits the open benefit.
  • With DNSBL queries, the visible source is often the recursive resolver and not the mail server.

Insights

  • Abuse protection can gradually turn an open community service into a closed one.
  • With DNS, source address models must distinguish between application and resolver.

Facts

  • Interested parties were asked to report the IP addresses of their querying DNS resolvers.

Recommendations

  • Protect authoritative DNS services with anycast, rate limits and several independent locations.
  • When using access controls, document which resolver addresses customers need to have approved.

References

Read the original article on Hostblogger

Search the Web Archive

KrebsOnSecurity · 2025

6.3 Tbit/s: What came after Mirai

Brian Krebs examines a short 6.3 Tbit/s attack and links it to Aisuru, compromised IoT devices and a publicly rented DDoS service. The attack reached more than 6.3 Tbit/s. Google measured around 585 million packets per second.

KrebsOnSecurity · 2016

620 Gbit/s: Mirai announces a new class of DDoS

Brian Krebs documents a DDoS attack that was exceptional at the time and whose direct traffic floods pointed to a large botnet of compromised IoT devices. The attack began on the evening of 20 September 2016. After analysis, Akamai put the peak load at around 620 Gbit/s.

Own note · 2016

A DDoS with almost 100 Mbit/s of incoming traffic

During a DDoS attack, live monitoring of eth0 showed 93.72 Mbit/s of incoming traffic at 21,246 packets per second, while almost nothing went out. vnStat was watching the network interface in live mode. Outgoing traffic was only 44 kbit/s at 19 packets per second.