What are DNS Amplification Attacks
DNS amplification attacks are a version of distributed denial-of-service attacks (also known as DDoS). These DNS amplification attacks use DNS servers as amplifiers.
The attack itself is rather simple: the attacker has their botnet send tens of thousands of DNS requests to one or more public DNS resolvers. The bots use the target’s IP address as sender IP so that the DNS resolver’s replies are sent to the target instead of the attacker. That way, the DNS resolvers submit tens of thousands of replies to the target.
This is what the communication structure looks like (the example has just one bot attacking):
The attacker also exploits a specific feature of the DNS protocol: requests directed to DNS servers are often much smaller than their replies. A request with just a few bytes can trigger a reply with thousands of bytes. For example, a 50-byte request can result in a 5000-byte reply – an amplification factor of 100. This means that the attacker need only send a fraction of the data volume that is supposed to hit their target. A bot with a bandwidth of 10 Mbps can run an attack on the order of 1 Gbps, and an entire botnet can easily reach hundreds of Gbps.
Even a simple request for an A record with a packet size of 74 bytes can lead to a 508-byte reply (an amplification factor of approximately 7). A request and reply like this might look as follows (no layer-2 and layer-3 header shown):
- Request from client (IP A.B.C.D) to DNS resolver (IP Q.W.E.R) for “www.thefqdn.de”, packet size of 74 bytes (©Link11)
This is what the botnet communication looks like including amplification:
The target faces several threats:
- Internet connection overload
- Overload of the components processing the packets
The worst possible outcome of this type of attack is complete failure of the target’s internet connection.
Stay updated on current DDoS reports, warnings, and news about IT security, cybercrime and DDoS protection.
Follow Link11 on Twitter
We had a great time at Wisdom of Crowds 2019 in London sharing our vision and ideas with other industry leaders and…
4 Retweets 2Read More
That was a great first day at IT-SA in Nuremberg! Today, we talked to Lasse Berger from Bayerischer Rundfunk about…
1 Retweets 2Read More
We are having a great time at it-sa - The IT Security Expo and Congress with Link11 COO Marc Wilczek on stage, tal…
2 Retweets 1Read More
Cybersecurity incidents are expected to rise by an alarming 70% by 2024. As the world is going digital, criminal ac…
0 Retweets 0Read More
Meet the team! Visit our booth (10.0-413) at it-sa 2019 from October 8-10 in Nuremberg and talk to our experts!…
1 Retweets 3Read More