{"id":78368,"date":"2013-05-26T22:59:04","date_gmt":"2013-05-26T20:59:04","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=78368"},"modified":"2013-05-26T23:00:16","modified_gmt":"2013-05-26T21:00:16","slug":"slow-adsl-it-could-be-a-cyber-attack","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/internet\/78368-slow-adsl-it-could-be-a-cyber-attack.html","title":{"rendered":"Slow ADSL? It could be a cyber-attack"},"content":{"rendered":"

A new type of distributed denial of service (DDoS<\/a>) attack that took Spamhaus<\/a> off the web for some hours (and \u201calmost broke the Internet<\/a>\u201d) has made its way to South Africa, causing major congestion on the ADSL<\/acronym> connections of infected users.<\/p>\n

This type of DDoS is known as a Domain Name System (DNS) amplification attack, and according to Cybersmart<\/a> CEO Laurie Fialkov,<\/a> started affecting his customers from mid-May (2013).<\/p>\n

Fialkov said that they first noticed something strange around 15 May 2013 when their \u201cspeed complaint\u201d and \u201ccan\u2019t browse\u201d problem categories started trending even though they had plenty of capacity everywhere.<\/p>\n

\u201cInitially we suspected that it was isolated to a few users,\u201d Fialkov said. \u201cIt was only when we saw overall DNS load go over 200Mbps that we realised it was some sort of DDoS attack.\u201d<\/p>\n

This load was created by only 327 customers on the Cybersmart network that were roped into the attack.<\/p>\n

What was particularly frustrating, Fialkov said, was that the exploit does not start immediately, \u201cso if you switch [Internet service providers], things run fine for a couple of hours until the bot finds the new nameserver and starts again.\u201d<\/p>\n

Fialkov explained that the attack generally uses \u201cANY\u201d DNS lookups against nameservers because it is the request that generates the biggest response.<\/p>\n

If an ADSL user generates enough of these \u201cANY\u201d queries to DNS servers the response could actually saturate their connection, Fialkov added.<\/p>\n

\u201cSo although the attack is aimed at bringing down a remote target like the root nameservers, or spamhaus.org, or some other well known target, the unfortunate side-effect is that it was affecting the speed of some of the ADSL users.\u201d<\/p>\n

\"Laurie

Laurie Fialkov<\/p><\/div>\n

Not necessarily a South African botnet or virus<\/h3>\n

Roelf Diedericks<\/a>, chief technology officer at Neology<\/a>, said some of their customers have also seen an uptick in this type of attack.<\/p>\n

\u201cWe have seen various levels of DNS DDoS attacks originating from infected customers on networks we are involved with,\u201d Diedericks said. \u201cThe activity has certainly increased over the past few weeks,\u201d he added.<\/p>\n

According to Diedericks, attackers find a foothold largely due to open resolvers, poorly configured DSL modems, and buggy firmware.<\/p>\n

Fialkov further explained that malware is actually the least common method they saw for perpetrating the DNS Amplification attacks that affected Cybersmartr users.<\/p>\n

In essence there are three forms of this attack, Fialkov said:<\/p>\n

    \n
  1. Modify the DNS packet and change the source address to a random IP on another network (such as Cybersmart\u2019s);<\/li>\n
  2. \u201cBrute force\u201d the username and passwords on routers and change a user\u2019s DNS settings to point to the corrupt DNS servers;<\/li>\n
  3. Malware (the least common).<\/li>\n<\/ol>\n

    Web Africa<\/a> chief technology officer, Rupert Bryant<\/a>, said that they haven\u2019t seen such attacks originating from their own users, but that international IPs have tried to use their DNS servers for such DoS attacks.<\/p>\n

    \"Roelf

    Roelf Diedericks<\/p><\/div>\n

    How do you stop a DNS Amplification attack?<\/h3>\n

    As a result of international IPs trying to perform DoS attacks by DNS amplification with their servers, Bryant said they have now locked down all their DNS servers to WebAfrica IP ranges.<\/p>\n

    \u201cWe use dynamic blackhole routing in our network to isolate the affected devices until fixed,\u201d Diedericks said when asked how they mitigate the effects of the attack.<\/p>\n

    While Cybersmart had some mitigating measures in place, such as caching of DNS queries and throttling of certain types of traffic, Fialkov said they also restricted the DNS servers their customers could use and limited the number of \u201cANY\u201d queries users were allowed per second.<\/p>\n

    \u201cWe restricted our ADSL customers to use only our caching nameservers, as well as nameservers that we deem to be trusted,\u201d Fialkov said.<\/p>\n

    A \u201ctrusted nameserver\u201d is any caching nameserver that could show it was rate-limiting \u201cANY\u201d DNS requests.<\/p>\n

    \u201cRate limiting the \u2018ANY\u2019 query can be done pretty safely without breaking anything,\u201d Fialkov said.<\/p>\n

    Modified DNS amplification attack \u201cfrightening indeed\u201d<\/h3>\n

    According to Fialkov, rate-limiting the \u201cANY\u201d DNS query gave immediate interim relief for exploited users, even though they continued to generate the same amount of queries as they were no longer getting the response.<\/p>\n

    This means that their line did not saturate and their speed returned mostly to normal, Fialkov said.<\/p>\n

    \u201cThe reason I say \u2018mostly to normal\u2019 is that sometimes the number of DNS requests could increase the load on the ADSL router, which would continue to cause speed issues,\u201d Fialkov added.<\/p>\n

    Fialkov expressed concern that a modified version of this DNS amplification attack would be much harder to mitigate.<\/p>\n

    \u201cThe reason for using the \u2018ANY\u2019 query is that it returns the biggest response, so it maximises the attack on the target,\u201d Fialkov explained.<\/p>\n

    For all intents and purposes, \u201cANY\u201d is a useless query as it is just summary of the all the other DNS queries, such as A, MX, SOA, AAAA, TXT, and CNAME.<\/p>\n

    \u201cA program can get the same information just by doing the queries individually,\u201d Fialkov said.<\/p>\n

    These queries have a much smaller response than \u201cANY\u201d, Fialkov said, which means that attackers would need more machines to have the same impact on the target.<\/p>\n

    What is a concern is that the attack could be modified to use one of these smaller, more widely used queries, or perhaps even a random combination of queries.<\/p>\n

    This would be almost impossible to stop from the ISP side, Fialkov said, as rate-limiting \u201cA\u201d record queries will have an impact on browsing experience.<\/p>\n

    \u201cA modified DNS amplification attack as described would be frightening indeed,\u201d Fialkov said.<\/p>\n

    \"Rupert

    Rupert Bryant<\/p><\/div>\n

    Attack from a South African source?<\/h3>\n

    In explaining the forms that the DNS amplification can take, Fialkov said that Cybersmart throttles UDP packets on their overseas routers that originate with a source address that can only occur within its network, but not on its peering links.<\/p>\n

    This should mitigate DNS amplification attacks of the first form Fialkov described (where the source address is spoofed) that originate internationally.<\/p>\n

    \u201cUDP packets are easily modified compared to TCP packets; so it is possible to send packets from outside our network, and to change the source to be from an IP in our network,\u201d Fialkov said.<\/p>\n

    \u201cThis will result in the answers coming back to random customers on our network without the customer being exploited at all,\u201d Fialkov explained.<\/p>\n

    Because of the fact that Cybersmart throttles UDP packets on its international routers, Fialkov said he believes that traffic from this type of attack would have originated within South Africa.<\/p>\n

    The target of the attack? The website of the Internet Systems Consortium: isc.org.<\/p>\n

    \u201cWe were not contributing at all to bringing down the target because the majority of the ‘ANY’ responses were cached,\u201d Fialkov said.<\/p>\n

    More information security and hacking articles<\/h3>\n

    Spyware servers in South Africa: the plot thickens<\/strong><\/a><\/p>\n

    SA first in Africa\u2026 for malware<\/strong><\/a><\/p>\n

    ABSA SIM swap fraud security feedback<\/strong><\/a><\/p>\n

    AARTO website hack: are you at risk?<\/strong><\/a><\/p>\n

    Biggest cyber attack in history slows global Internet<\/strong><\/a><\/p>\n

    CO.ZA suffers DDoS attack<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

    ADSL users complaining about unusable, slow connections turned out to be collateral damage in a type of DDoS attack known as “DNS Amplification”, explains Cybersmart<\/p>\n","protected":false},"author":15,"featured_media":74148,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[18,27],"tags":[2954,19562,19568,19564,35,19566,4358,1067,12973,5250,13605,329],"class_list":["post-78368","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-internet","category-security","tag-cybersmart","tag-distributed-denial-of-service-ddos","tag-dns-amplification-attack","tag-domain-name-system-dns","tag-headline","tag-internet-systems-consortium","tag-laurie-fialkov","tag-neology","tag-roelf-diedericks","tag-rupert-bryant","tag-spamhaus","tag-web-africa"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/78368"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=78368"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/78368\/revisions"}],"predecessor-version":[{"id":78722,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/78368\/revisions\/78722"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/74148"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=78368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=78368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=78368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}