DNS amplification attacks are on the rise

guest · Jun 14, 2018

DNS amplification attacks double in Q1 2018
June 14, 2018
https://www.helpnetsecurity.com/2018/06/14/dns-amplification-attacks-q1-2018/

DNS amplification types of DDoS attacks doubled in the first quarter of 2018 over last quarter, and spiked nearly 700 percent year-over-year, according to Nexusguard.

Nexusguard’s Q1 2018 Threat Report, which analyzes thousands of global cyber attacks, reported that 55 of the attacks were due to exploited Memcached servers.

“Cyber attackers continue to seek new vulnerabilities to pursue more firepower, launching more amplification attacks through unguarded Memcached servers and poorly configured DNSSEC-enabled DNS servers the past two quarters, and we expect this trend to continue,” said Juniman Kasman, CTO for Nexusguard.
Click to expand...

guest · Sep 16, 2019

DNS amplification attacks increase 1,000 percent
September 16, 2019
https://betanews.com/2019/09/16/dns-amplification-1000-percent/

The second quarter of 2019 saw DNS amplification DDoS attacks up more than 1,000 percent over the same period last year according to the latest threat report from Nexusguard.

Nexusguard researchers attribute Domain Name System Security Extensions (DNSSEC) with fueling the new wave of DNS amplification attacks, which accounted for more than 65 percent of the attacks last quarter according to the team's evaluation of thousands of worldwide DDoS attacks.
The growing adoption of DNSSEC technology though suggests that DNS amplification risks won't disappear for service providers or enterprise networks anytime soon.

"Due to the long responses they generate, attackers often abuse DNSSEC to launch amplification attacks that clog victim networks and hosts, which will remain a significant threat in the future."
Click to expand...

Nexusguard: Nexusguard research reveals 1,000% increase in DNS amplification attacks since last year
DDoS Threat Report 2019 Q2

guest · Sep 24, 2019

'Carpet-bombing' DDoS attack takes down South African ISP for an entire day
September 24, 2019
https://www.zdnet.com/article/carpe...kes-down-south-african-isp-for-an-entire-day/

Mysterious attackers have taken down a South African internet service provider over the weekend using a DDoS technique called carpet bombing, ZDNet has learned.
The DDoS attacks took place on Saturday and Sunday, September 21 and 22, and have targeted Cool Ideas, one of South Africa's largest ISPs.

As a result of this attack, Cool Ideas customers experienced "intermittent connectivity loss and degraded performance" for any connection trying to access an international service or website, the company said on its public status page.
ATTACKERS LAUNCHED A FOLLOW-UP ATTACK
While Cool Ideas did not respond to a request for comment that ZDNet sent yesterday, Paul Butschi, Cool Ideas co-founder, told a local news outlet that the attackers kept an eye on how the ISP handled the attack and they reacted accordingly.
As soon as Cool Ideas managed to mitigate the first DDoS attack wave and announced it was slowly resuming service, another DDoS attack hit within minutes, taking down the ISP's systems once again.
Click to expand...

DNS+CLDAP AMPLIFICATION ATTACKS, CARPET BOMBING STYLE
All the attacks that have hit Cool Ideas were so-called DDoS amplification attacks that leveraged the DNS and CLDAP protocols.
Hackers sent junk traffic to unpatched DNS and CLDAP servers, which, in turn, reflected traffic towards Cool Ideas' network at an amplified size -- hence the DDoS amplification attack term.
Click to expand...

guest · Dec 16, 2019

DNS amplification attacks continue to grow
December 16, 2019
https://betanews.com/2019/12/16/dns-amplification-attacks-grow/

DNS amplification attacks have grown by over 4,000 percent over the last year according to Nexusguard's latest threat report.

DNSSEC (Domain Name System Security Extensions) remains the main source of growth in DNS amplification attacks in the quarter, but Nexusguard analysts have also detected a sharp and concerning rise in TCP SYN Flood attacks.

"Telcos and enterprises must take note while these tactics don’t cause notable strain on network bandwidth, which may go undetected, but that they are powerful enough to impact their service. Advanced mitigation techniques are required to address these threats."
The report reveals that 44 percent of Q3 attack traffic came from botnet-hijacked Windows computers and servers. The second largest source of traffic came from iOS-equipped mobile devices. The total number of attacks has mirrored patterns observed in 2019, with Q1 seeing the highest number attacks followed by numbers dropping over Q2 and Q3.
Click to expand...

Nexusguard: DDoS Threat Report 2019 Q3

guest · Sep 5, 2020

Exposed Windows Domain Controllers Used in CLDAP DDoS Attacks
September 1, 2020
https://isc.sans.edu/diary/rss/26526

LDAP, like many UDP based protocols, has the ability to send responses that are larger than the request. With UDP not requiring any handshake before data is sent, these protocols make ideal amplifiers for reflective distributed denial of service attacks. Most commonly, these attacks abuse DNS and we have talked about this in the past. But LDAP is another protocol that is often abused.

CLDAP has been on the radar for DDoS attacks at least since 2014 (likely earlier, but this is the earliest mention I found with a little bit of Google): https://us-cert.cisa.gov/ncas/alerts/TA14-017A . But as recent as in June, CLDAP was a component of major DDoS attacks ( https://blogs.akamai.com/2020/06/akamai-mitigates-sophisticated-144-tbps-and-385-mpps-ddos-attack.html )
Some of our honeypots have been seeing a small number of the reflected packets from these attacks. In investigating them, we noticed that many of them appear to come from exposed windows domain controllers.

So what should you do? I do not know of a good reason to allow clear text LDAP (Port 389, not LDAP over TLS) across your perimeter. Close that port!
Click to expand...

guest · Jul 25, 2022

Adversarial attacks can cause DNS amplification, fool network defense systems, machine learning study finds
New research shows how deep learning models trained for network intrusion detection can be bypassed
July 25, 2022

Recent years have seen a growing interest in the use of machine learning and deep learning in cybersecurity, especially in network intrusion detection and prevention.

However, according to a study by researchers at the Citadel, a military college in South Carolina, US, deep learning models trained for network intrusion detection can be bypassed through adversarial attacks, specially crafted data that fools neural networks to change their behavior.
Click to expand...

DNS amplification attacks
The study (PDF) focuses on DNS amplification, a kind of denial-of-service attack in which the attacker spoofs the victim’s IP address and sends multiple name lookup requests to a DNS server.
The server will then send all the responses to the victim.

“We decided to study deep learning in DNS amplification due to the increasing popularity of machine learning-based intrusion detection systems,” Jared Mathews, the lead author of the paper, told The Daily Swig.
“DNS amplification is one of the more popular and destructive forms of DoS attacks so we wanted to explore the viability and resilience of a deep learning model trained on this type of network traffic.”
Click to expand...

arXiv: A Deep Learning Approach to Create DNS Amplification Attacks

Two algorithms of interest are the Elastic-Net Attack on Deep Neural Networks and TextAttack. In our experiment the EAD and TextAttack algorithms are applied to a Domain Name System amplification classifier.

The algorithms are used to generate malicious Distributed Denial of Service adversarial examples to then feed as inputs to the network intrusion detection systems neural network to classify as valid traffic. We show in this work that both image processing and natural language processing adversarial learning algorithms can be applied against a network intrusion detection neural network.
Click to expand...

(PDF): https://arxiv.org/pdf/2206.14346.pdf

Log in or Sign up

DNS amplification attacks are on the rise

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

DNS amplification attacks are on the rise

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches