Re: A code red that could bring down the net?

From: Felix Harris (felixh@netcomuk.co.uk)
Date: 07/24/01 

From: "Felix Harris" <felixh@netcomuk.co.uk>
To: michael@mastergeek.com
Date: Tue, 24 Jul 2001 11:25:51 +0100
Subject: Re: A code red that could bring down the net?
Message-ID: <3B5D5B3F.5692.B0F03A@localhost>

> 1) The Internet has a limited number of root name
> servers.
I'm going to make a stab in the dark, but this also assumes that
nameservers don't cache translations, and by nameservers I mean
the ones on ISPs and localhosts around the world. This would
mean that a DoS would have to operate until the cache expired, by
which time the attacking hosts could have been filtered, or the root
nameservers could have been kicked.

> 2) An application can easilly be created to perform a
> DOS attack on these root servers.

As I've said previously, DDos wouldn't work particularly well,
because there's a lot of hosts to hit, and the root nameservers are
fairly well maintained. The next suggestion would be just a typical
memory leaky-thingy (I love technical terms) or something along
those lines to kill the named. This is also fairly difficult as the
primary nameservers run different nameds (as far as I know), and
so would require multiple applications to be flawed.

my first post, yay. 

--
Felix Harris (Felix-_@IRCNet)
felix@warlords.net

Relevant Pages

  • Re: A code red that could bring down the net?
    ... nameservers don't cache translations, ... which time the attacking hosts could have been filtered, or the root ... > DOS attack on these root servers. ... primary nameservers run different nameds, ...
    (Vuln-Dev)
  • Re: Restricting access to a web server by IP
    ... > remote control clients, etc - we remotely ... > The agrument against is that mpst vulnerabilities seem to come through ... > servers, and blocking access to all IPs accept those on the allowed list - ...
    (comp.security.misc)
  • Re: Restricting access to a web server by IP
    ... > remote control clients, etc - we remotely ... > The agrument against is that mpst vulnerabilities seem to come through ... > servers, and blocking access to all IPs accept those on the allowed list - ...
    (comp.security.firewalls)
  • Re: Restricting access to a web server by IP
    ... > remote control clients, etc - we remotely ... > The agrument against is that mpst vulnerabilities seem to come through ... > servers, and blocking access to all IPs accept those on the allowed list - ...
    (alt.computer.security)
  • Re: Forest to Child -- Permissions
    ... My account can login to all the DCs and has full administrator priv. ... first DC in the root. ... the member servers only ... never happen unless some admin has been mucking about. ...
    (microsoft.public.windows.server.dns)