Attackers find new ways to deliver DDoSes with “alarming” sophistication

“As a result, for each test call, two UDP packets are sent to the issuer, enabling an attacker to direct this traffic to any IP and port number to amplify a DDoS attack,” the Cloudflare researchers wrote. “Despite the vulnerability, only a few thousand of these devices are exposed, limiting the potential scale of attack, and attacks must run serially, meaning each device can only launch one attack at a time.”

DNS Laundering attacks. These were the third DDoS technique in vogue last quarter. As the resource that translates domain names into IP addresses, the domain name system is crucial for data to get from one place to another. By flooding a target’s DNS infrastructure with more lookup requests than it has the resources to handle, attackers have long been able to make targeted services unavailable.

This type of attack can have devastating consequences for the entire Internet, as the world learned in 2016, when a relatively small network of infected routers and other devices exhausted the resources of DNS provider Dyn. As a result, Twitter, GitHub, the PlayStation network, and hundreds of other properties that relied on Dyn came to a standstill.

Now that defenders are better at filtering out malicious DNS requests, attackers have begun leveraging DNS Laundering attacks. The Cloudflare researchers explained:

In a DNS Laundering attack, the threat actor will query subdomains of a domain that is managed by the victim’s DNS server. The prefix that defines the subdomain is randomized and is never used more than once or twice in such an attack. Due to the randomization element, recursive DNS servers will never have a cached response and will need to forward the query to the victim’s authoritative DNS server. The authoritative DNS server is then bombarded by so many queries until it cannot serve legitimate queries or even crashes all together.

From the protection point of view, the DNS administrators can’t block the attack source because the source includes reputable recursive DNS servers like Google’s 8.8.8.8 and Cloudflare’s 1.1.1.1. The administrators also cannot block all queries to the attacked domain because it is a valid domain that they want to preserve access to legitimate queries.

The above factors make it very challenging to distinguish legitimate queries from malicious ones. A large Asian financial institution and a North American DNS provider are amongst recent victims of such attacks. An example of such an attack is provided below.

Virtual-machine botnets. The last technique the researchers identified as on the rise was the use of virtual-machine botnets. Rather than relying on infected routers and other Internet-connected devices, attackers use VMs or virtual private servers. The computational and bandwidth resources of these botnets dwarf the capacity of more traditional botnets to deliver “hyper-volumetric” DDoSes.