Hacker News Reader

Comment by adzm | Hacker News Reader

> many large TXT records can be abused for DDoS purposes. dig -t txt ebay.com for a DDoS Example used today

What does this mean, I see a bunch in the lookup but I don't understand the ddos part

If a site has a large set of TXT records, they can be used by clients that spoof packets to request large volumes of answers by DNS servers. This is called an amplification attack. Many tiny spoofed requests in, many large answers out.

That's just the braindeqd design of DNS, responding to arbitrary UDP packets without authenticating the IP address of the sender.

Indeed. For what it's worth the spoofing aspect got better for a while then plateaued. [1] bcp84 / bcp38 adoption has pretty much stalled out. No idea what to do with the remaining ISP's.

[1] - https://spoofer.caida.org/summary.php

Nah. That's just the lazy-ass traffic filtering policies of poorly-run end-user ISPs. [0] Every end-user ISP knows what IP address ranges it has assigned to each customer. It's fairly trivial to note when the source address of traffic coming from a customer's connection isn't in the range that has been assigned to that connection and drop it on the floor. This stops source address spoofing dead.

RFC 2827 (BCP 38) was published in May 2000. There's no good excuse for end-user ISPs to not be doing this for pretty much all of their customers.

[0] For the purposes of this discussion, I'm declaring that "cloud" providers are ISPs. They provide IP addresses and Internet connectivity to their customers, so they count.

Reply on news.ycombinator.com