<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body>
<p>Hi dnsdist users.</p>
<p>I would like to share a little finding with you. We have been suffering from pseudorandom subdomain attacks fo more than two years mainly because openresolvers in crappy CPEs of our customers. While analyzing the DNS traffic using topResponses in dnsdist (thanks!) I have noticed that there is an non negligible amount of queries like this:</p>
<p><span style="font-family: courier new,courier;">89.24.226.150 -> 93.153.117.1 DNS 131 Standard query 0x45f8 A 13070798-0-2081296634-622260844.ns.124-14-16-250-ns.dns-spider.myxns.cn </span><br /><span style="font-family: courier new,courier;">89.24.226.150 -> 93.153.117.1 DNS 130 Standard query 0x57f7 A 7231664-0-1896986649-671701647.ns.113-17-184-25-ns.dns-spider.myxns.cn </span><br /><span style="font-family: courier new,courier;">89.24.226.150 -> 93.153.117.1 DNS 130 Standard query 0x9c0c A 7231664-0-1896986649-671701647.ns.113-17-184-25-ns.dns-spider.myxns.cn</span></p>
<p><span style="font-family: courier new,courier;">46.13.117.67 -> 93.153.117.1 DNS 130 Standard query 0x08fd A 2434136-0-3661366674-4096880849.ns.218-60-5-146-ns.dns-spider.myxns.cn</span><br /><span style="font-family: courier new,courier;">46.13.117.67 -> 93.153.117.1 DNS 130 Standard query 0xf473 A 2434136-0-3661366674-4096880849.ns.218-60-5-146-ns.dns-spider.myxns.cn</span></p>
<p>They are coming from clients wit openresolvers. I supposed that this traffic is malicious and it nothing what would a real user created by browsing web pages, etc. I have created rules dropping such traffic:</p>
<p><span style="font-family: courier new,courier;">addAction(RegexRule("dns-spider.*\\.cn$"), DropAction())</span><br /><span style="font-family: courier new,courier;">addAction(RegexRule("dns-spider.*\\.net$"), DropAction())</span><br /><span style="font-family: courier new,courier;">addAction(RegexRule("dns-spider.*\\.org$"), DropAction())</span><br /><span style="font-family: courier new,courier;">addAction(RegexRule("dns-spider.*\\.com$"), DropAction())</span></p>
<p>I have more than 100k hits per day for the first rule and thousands for the second one. To my surprise the pseudorandom subdomain attack stopped since the rules are installed! And it last more than two months. My idea is that some bad guys are using specially crafted queries above to detect openresolvers and exploit them later on as the query reaches the authoritative NS where can be matched with the IP of the initial target.</p>
<p>And maybe one more interesting thing. Some CPEs have something like "hidden openresolver". They will not answer you if you query them on WAN nevertheless they send the query to the upstream resolver which allow them to be exploited as well.</p>
<p>With regards</p>
<p>Ales</p>
<p> </p>
</body></html>