Internet security experts say that misconfigured digital subscriber line and cable modems are worsening a well-known problem with the Internet’s DNS (domain name system), making it easier for hackers to launch distributed denial-of-service (DDoS) attacks against their victims.
In fact, the percentage of DNS systems on the Internet that are configured this way has jumped from around 50 per cent in 2007, to nearly 80 per cent this year, according to Liu.
Though he hasn’t seen the Infoblox data, Georgia Tech Researcher David Dagon agreed that open recursive systems are on the rise, in part because of “the increase in home network appliances that allow multiple computers on the Internet.”
“Almost all ISPs distribute a home DSL/cable device,” he said in an e-mail interview. “Many of the devices have built-in DNS servers. These can sometimes ship in ‘open by default’ states.”
Because modems configured as open recursive servers will answer DNS queries from anyone on the Internet, they can be used in what’s known as a DNS amplification attack.
In this attack, hackers send spoofed DNS query messages to the recursive server, tricking it into replying to a victim’s computer. If the bad guys know what they’re doing, they can send a small 50 byte message to a system that will respond by sending the victim as much as 4 kilobytes of data. By barraging several DNS servers with these spoofed queries, attackers can overwhelm their victims and effectively knock them offline.
DNS experts have known about the open recursive configuration problem for years, so it’s surprising that the numbers are jumping up.
However, according to Dagon, a more important issue is the fact that many of these devices do not include patches for a widely publicizedDNS flaw discovered by researcher Dan Kaminsky last year. That flaw could be used to trick the owners of these devices into using Internet servers controlled by hackers without ever realizing that they’ve been duped.
Infoblox estimates that 10 percent of the open recursive servers on the Internet have not been patched.
The Infoblox survey was conducted by The Measurement Factory, which gets its data by scanning about 5 percent of the IP addresses on the Internet. The data will be posted here in the next few days.
According to Measurement Factory President Duane Wessels, DNS amplification attacks do occur, but they’re not the most common form of DDoS attack. “Those of us that track these and are aware of it tend to be a little bit surprised that we don’t see more attacks that use open resolvers,” he said. “It’s kind of a puzzle.”
Wessels believes that the move toward the next-generation IPv6 standard may be inadvertently contributing to the problem. Some of the modems are configured to use DNS server software called Trick or Tread Daemon (TOTd) — which converts addresses between IPv4 and IPv6 formats. Often this software is configured as an open resolver, Wessels said.
