Administrace komentářů

Od: NFOservers.com DDoS notifier 
Komu: abuse@netbox.cz
Předmět: Open recursive resolver used for an attack: 83.240.112.222
Datum: 2014-11-14 04:36:05

You appear to be running an open recursive resolver at IP address 83.240.107.108
that participated in an attack against a customer of ours, generating large UDP
responses to spoofed queries, with those responses becoming fragmented because of
their size.

Please consider reconfiguring your resolver in one or more of these ways:

- To only serve your customers and not respond to outside IP addresses (in BIND,
this is done by defining a limited set of hosts in "allow-query"; with a Windows
DNS server, you would need to use firewall rules to block external access to UDP
port 53)
- To only serve domains that it is authoritative for (in BIND, this is done by
defining a limited set of hosts in "allow-query" for the server overall but
setting "allow-query" to "any" for each zone)
- To rate-limit responses to individual source IP addresses (such as by using DNS
Response Rate Limiting or iptables rules)

More information on this type of attack and what each party can do to mitigate it
can be found here: http://www.us-cert.gov/ncas/alerts/TA13-088A

If you are an ISP, please also look at your network configuration and make sure
that you do not allow spoofed traffic (that pretends to be from external IP
addresses) to leave the network. Hosts that allow spoofed traffic make possible
this type of attack.

Example DNS responses from your resolver during this attack are given below.
Timestamps (far left) are PDT (UTC-7), and the date is 2014-11-13.

18:25:47.977451 IP (tos 0x0, ttl 52, id 24962, offset 0, flags [+], proto UDP
(17), length 1500) 83.240.107.108.53 > 66.150.188.x.26763: 41910 11/2/0
wradish.com. TXT[|domain]
0x0000:  4500 05dc 6182 2000 3411 40a7 53f0 6b6c  E...a...4.@.S.kl
0x0010:  4296 bcf5 0035 688b 0efa f896 a3b6 8180  B....5h.........
0x0020:  0001 000b 0002 0000 0777 7261 6469 7368  .........wradish
0x0030:  0363 6f6d 0000 ff00 01c0 0c00 1000 0100  .com............
0x0040:  000d 7104 05ff 7465 7374 2074 6573 7420  ..q...test.test.
0x0050:  7465                                     te
18:25:47.984342 IP (tos 0x0, ttl 52, id 24963, offset 0, flags [+], proto UDP
(17), length 1500) 83.240.107.108.53 > 66.150.188.x.48542: 31514 11/2/0
wradish.com. MX[|domain]
0x0000:  4500 05dc 6183 2000 3411 40a6 53f0 6b6c  E...a...4.@.S.kl
0x0010:  4296 bcf5 0035 bd9e 0efa a9ce 7b1a 8180  B....5......{...
0x0020:  0001 000b 0002 0000 0777 7261 6469 7368  .........wradish
0x0030:  0363 6f6d 0000 ff00 01c0 0c00 0f00 0100  .com............
0x0040:  000d 7100 1900 0004 736d 7470 0c73 6563  ..q.....smtp.sec
0x0050:  7572                                     ur
18:25:48.115673 IP (tos 0x0, ttl 52, id 24965, offset 0, flags [+], proto UDP
(17), length 1500) 83.240.107.108.53 > 66.150.188.x.61319: 31514 11/2/0
wradish.com. MX[|domain]
0x0000:  4500 05dc 6185 2000 3411 40a4 53f0 6b6c  E...a...4.@.S.kl
0x0010:  4296 bcf5 0035 ef87 0efa b00b 7b1a 8180  B....5......{...
0x0020:  0001 000b 0002 0000 0777 7261 6469 7368  .........wradish
0x0030:  0363 6f6d 0000 ff00 01c0 0c00 0f00 0100  .com............
0x0040:  000d 7100 1f00 0a0a 6d61 696c 7374 6f72  ..q.....mailstor
0x0050:  6531                                     e1

(The final octet of our customer's IP address is masked in the above output
because some automatic parsers become confused when multiple IP addresses are
included. The value of that octet is "245".)

-John
President
Nuclearfallout, Enterprises, Inc. (NFOservers.com)

(We're sending out so many of these notices, and seeing so many auto-responses,
that we can't go through this email inbox effectively. If you have follow-up
questions, please contact us at noc@nfoe.net.)