Given enough bandwidth and a unique idea, anything is possible, it is true. You provided a 2MB text list of DNS servers, approximately 200,000 of them. They sit across most of the v4 IP ranges available (and some IPV6 ones). This means upstream links won't likely be saturated, and filtering can likely be done on the server based on heuristics. If you're going to ask for 100% random non-existent domains you're easy to beat - if( failed_request() > 99% ) { drop_packet() }. If you're going to ask for TLDs that exist, they're already cached by anyone running a half-decent server, and they're going to send you elsewhere. You might cause issues for individual downstream ranges as people get heavy-handed with filtering, but you've included google's servers in there and I'm guessing the roots are there too. They're anycast and backed by some crazy bandwidth. Of course it might work once, for a short time, but you've just told some spectacular engineers out there to think about this problem, and they've definitely already considered it ;) James On Tue, 6 Oct 2015, at 01:39, Jeffrey Roberts wrote: > If you were to have a botnet which were to flood random DNS queries > for domains that did not exist to the list of DNS servers hosted on > http://ift.tt/1KWK74y then the root dns servers and > the tld dns servers would be overwhelmed without any way to filter the > packets, if they were to filter the packets of the DNS servers, they > themselves would be turning off DNS, hence they can not do that... If > the botnet only hits the DNS servers on the list a few times, > filtering those packets would be insignificant. This attack should in > essence turn off DNS for the world, hence, turning off the internet as > the public knows it today. > >
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment