Re: [Full-disclosure] New DDoS attack vector
- From: ascii <ascii@xxxxxxxxxxxx>
- Date: Fri, 20 May 2011 15:43:03 +0200
On 05/20/2011 02:10 PM, minor float wrote:
not really, because we have seen that they've used more than one smtp
server for this.
the attack you proposed is very stretched and has an extremely low
efficiency. What follows is my feeling about the issue and I don't
exclude that I could be missing some key concept.
The idea behind well executed DoS attacks is that little resources
on the attacker's side cause big disruption on the victim's assets.
This together with the fact that big MTA clusters are likely to use
a caching DNS server to speed up lookups and delivery is enough to
dismiss your research as largely uninteresting.
The call about the urgent need of a task-force to face this nasty and
dangerous attack, in pure dnsinsky hype style, and the advice to
"tighten the rules when registering the domains" make the whole thing
Best quote: "As we already wrote in this paper, the number of recorded
bots during the attack observation was about 14.000 with more than
100.000 spam messages. The target was just one DNS server and only one
pre-registered domain was used. The white horse systems were able to
disrupt the DNS server operation for more than one day and the effi-
ciency of such attack was very high."
14.000 bots to take down one DNS server? UMH.
Francesco `ascii` Ongaro
Original url: http://www.zone-h.org/news/id/4739
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/