DNS servers do hackers' dirty work

TalkBack 1 of 15:

Next »

• Thread View
• Flat View

Open relays (again)

This is just like open SMTP relays, only worse. Instead of just loads of spam from an identifiable host that can be blacklisted, now it is a DDoS attack.

Wait for the chorus of non-admins: "You can't turn off recursive queries-- we need them to bypass ____ (fill in blank)". They will bring up privacy, anonymity, and other dire consequences of operating DNS servers with the recommended configuration (not allowing ingress recursive queries).

Again, it's just like open SMTP relays. Chicken littles all over bemoaned the days when they could no longer send anonymous email after everyone shut down their wide open servers (how selfish-- "fix the spam problem, but don't do anything that will make me do any more work"). Guess what? The sky did not fall, open relays have been shut down or blacklisted, and you can still send mail anonymously (albeit using different techniques that don't damage the internet).

So to preemt the enevitable posts of how turning off recursive queries will destroy the cooperative nature of the internet-- get a clue! We can no longer function as if everyone is friendly. Responsible admins need to assume that hackers and crackers will exploit any and all attack vectors. To do otherwise is a disservice to their customers, to their employers (and shareholders), and yes-- the entire internet.

Running a well connected SMTP server is a serious responsibility. Do it right or let someone else. Now we know the same holds true for DNS servers.

Thus endeth the lesson.

Posted by: RestonTechAlec   Posted on: 03/24/06 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Get top-ranked Novell support for Red Hat at 50% less Novell A simplified IT environment isn't just less complex, it's more reliable. ... Download Now
• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now