DNS.be takes action against amplification attack

News 31-01-2013

Between Sunday 27 January 2013, around midnight, and Tuesday 29 January 2013, around 5:00, our .be name servers received strikingly more queries than normal. In case this amount would become too high, this could possibly result in for instance a slower access to .be websites. But the stable DNS.be infrastructure makes sure the end user does not experience any noticeable delay.

A massive flow of queries isn’t just a heavy load on our infrastructure, the ultimate aim of this attack is to have DNS.be play an amplifying factor in reaching certain targets. This malicious technique is called an “amplification attack” or “DNS reflection attack”. The attacker uses this technique to launch a DDOS attack on the IP address of the victim via the DNS.be name servers.

Obviously, DNS.be doesn’t want to participate in DDOS attacks. We are doing all in our power to ensure the continuity of our service, while at the same time taking the necessary action to limit the damage of such an attack on the targeted third party. It might have been possible therefore that some of our name servers were responding a bit slower than usual. The query-answers are stabilized at the moment, and the attack has stopped.

Although the “amplification attack” technique has been known for over 10 years, we’ve noticed that since 2012 unfortunately this technique has been used more often. Since the introduction of DNSSEC, this technique has become significantly more interesting because DNSSEC query answers are bigger, which is in the ‘advantage’ to the amplification. We have noticed that other TLD’s are also frequently targeted by these attacks. Therefore several initiatives on an international level exist to fight these abuses.

go to original article

Published By

Back to all news