That is the same attack vector yes, although obviously not specifically targeted to one site.<div><br></div><div>The funny thing is how those guys don't seem to understand Anycast and that their attack will do bugger all especially with about 4 layers of DNS caching after the root servers. facepalm.<br>
<br><div class="gmail_quote">On Fri, Nov 2, 2012 at 8:26 PM, Jarryd Sullivan <span dir="ltr"><<a href="mailto:Jarryd.Sullivan@area9.com.au" target="_blank">Jarryd.Sullivan@area9.com.au</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I came across this a while ago and when I read about the attack in the article it reminded me of it...Excuse me for not completely understanding it but I believe what is described in this link is pretty much what happened?<br>
<br>
<a href="http://pastebin.com/NKbnh8q8" target="_blank">http://pastebin.com/NKbnh8q8</a><br>
<br>
Excuse the disclaimer it's appended automatically.<br>
________________________________________<br>
From: <a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a> [<a href="mailto:ausnog-bounces@lists.ausnog.net">ausnog-bounces@lists.ausnog.net</a>] on behalf of Mark Smith [<a href="mailto:markzzzsmith@yahoo.com.au">markzzzsmith@yahoo.com.au</a>]<br>
Sent: Friday, November 02, 2012 6:21 PM<br>
To: <a href="mailto:ausnog@ausnog.net">ausnog@ausnog.net</a><br>
Subject: [AusNOG] Why BCP38 is important<br>
<div><div class="h5"><br>
"Open DNS resolvers behind gigantic DDoS"<br>
<a href="http://www.itnews.com.au/News/321618,open-dns-resolvers-behind-gigantic-ddos.aspx" target="_blank">http://www.itnews.com.au/News/321618,open-dns-resolvers-behind-gigantic-ddos.aspx</a><br>
<br>
<br>
The article is a bit incorrect in concluding that the only cause is DNS<br>
resolvers available to anybody, it is also because the hosts that are used<br>
in the DDoS can spoof source addresses, causing the DNS resolver replies<br>
to be sent instead to DDoS attack victim.<br>
<br>
If you're unfamiliar with BCP38, please read the following and then implement<br>
it to help prevent these sorts of attacks.<br>
<br>
"Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing"<br>
<a href="http://tools.ietf.org/html/bcp38" target="_blank">http://tools.ietf.org/html/bcp38</a><br>
<br>
<br>
For ISPs, BCP38 will also prevent the "quota free tunnels" presented by Warren at this year's Ausnog:<br>
<br>
Using a lack of source address filtering to create 'quota-free' tunnels between collaborators<br>
<a href="http://www.ausnog.net/images/ausnog-2012/presentations/05-ausnog2012-WarrenHarrop.pdf" target="_blank">http://www.ausnog.net/images/ausnog-2012/presentations/05-ausnog2012-WarrenHarrop.pdf</a><br>
<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<br>
</div></div>________________________________<br>
<br>
The information contained in this message and any attachments may be confidential information. If you are not the intended recipient, you must not use or forward the information contained in these documents. If you have received this message in error, please delete the email and notify the sender.<br>
<br>
Internet communications are not secure. You should scan this message and any attachments for viruses. Under no circumstances do we accept liability for any loss or damage which may result from your receipt of this message or any attachments.<br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div></div></blockquote></div><br></div>