Browsing articles from "1月, 2014"
1月 27, 2014

最近のDNS Amp Attack

最近はAレコードを複数設定したドメインを準備してAttackを仕掛けるパターンが多い。

◆saveroads.ru
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25246 ;; flags: qr rd ra; QUERY: 1, ANSWER: 243, AUTHORITY: 0, ADDITIONAL: 12 ;; QUESTION SECTION: ;saveroads.ru. IN ANY ;; ANSWER SECTION: saveroads.ru. 86399 IN A 204.46.43.172 saveroads.ru. 86399 IN A 204.46.43.173 saveroads.ru. 86399 IN A 204.46.43.174 saveroads.ru. 86399 IN A 204.46.43.175 saveroads.ru. 86399 IN A 204.46.43.176 saveroads.ru. 86399 IN A 204.46.43.177 saveroads.ru. 86399 IN A 204.46.43.178 saveroads.ru. 86399 IN A 204.46.43.179 saveroads.ru. 86399 IN A 204.46.43.180 saveroads.ru. 86399 IN A 204.46.43.181 saveroads.ru. 86399 IN A 204.46.43.182 saveroads.ru. 86399 IN A 204.46.43.183 saveroads.ru. 86399 IN A 204.46.43.184 saveroads.ru. 86399 IN A 204.46.43.185 saveroads.ru. 86399 IN A 204.46.43.186 saveroads.ru. 86399 IN A 204.46.43.187 saveroads.ru. 86399 IN A 204.46.43.188 saveroads.ru. 86399 IN A 204.46.43.189 saveroads.ru. 86399 IN A 204.46.43.190 saveroads.ru. 86399 IN A 204.46.43.191 saveroads.ru. 86399 IN A 204.46.43.192 saveroads.ru. 86399 IN A 204.46.43.193 saveroads.ru. 86399 IN A 204.46.43.194 saveroads.ru. 86399 IN A 204.46.43.195 saveroads.ru. 86399 IN A 204.46.43.196 saveroads.ru. 86399 IN A 204.46.43.197 saveroads.ru. 86399 IN A 204.46.43.198 saveroads.ru. 86399 IN A 204.46.43.199 saveroads.ru. 86399 IN A 204.46.43.200 saveroads.ru. 86399 IN A 204.46.43.201 saveroads.ru. 86399 IN A 204.46.43.202 saveroads.ru. 86399 IN A 204.46.43.203 saveroads.ru. 86399 IN A 204.46.43.204 saveroads.ru. 86399 IN A 204.46.43.205 saveroads.ru. 86399 IN A 204.46.43.206 saveroads.ru. 86399 IN A 204.46.43.207 saveroads.ru. 86399 IN A 204.46.43.208 saveroads.ru. 86399 IN A 204.46.43.209 saveroads.ru. 86399 IN A 204.46.43.210 saveroads.ru. 86399 IN A 204.46.43.211 saveroads.ru. 86399 IN A 204.46.43.212 saveroads.ru. 86399 IN A 204.46.43.213 saveroads.ru. 86399 IN A 204.46.43.214 saveroads.ru. 86399 IN A 204.46.43.215 saveroads.ru. 86399 IN A 204.46.43.216 saveroads.ru. 86399 IN A 204.46.43.217 saveroads.ru. 86399 IN A 204.46.43.218 saveroads.ru. 86399 IN A 204.46.43.219 saveroads.ru. 86399 IN A 204.46.43.220 saveroads.ru. 86399 IN A 204.46.43.221 saveroads.ru. 86399 IN A 204.46.43.222 saveroads.ru. 86399 IN A 204.46.43.223 saveroads.ru. 86399 IN A 204.46.43.224 saveroads.ru. 86399 IN A 204.46.43.225 saveroads.ru. 86399 IN A 204.46.43.226 saveroads.ru. 86399 IN A 204.46.43.227 saveroads.ru. 86399 IN A 204.46.43.228 saveroads.ru. 86399 IN A 204.46.43.229 saveroads.ru. 86399 IN A 204.46.43.230 saveroads.ru. 86399 IN A 204.46.43.231 saveroads.ru. 86399 IN A 204.46.43.232 saveroads.ru. 86399 IN A 204.46.43.233 saveroads.ru. 86399 IN A 204.46.43.234 saveroads.ru. 86399 IN A 204.46.43.235 saveroads.ru. 86399 IN A 204.46.43.236 saveroads.ru. 86399 IN A 204.46.43.237 saveroads.ru. 86399 IN A 204.46.43.238 saveroads.ru. 86399 IN A 204.46.43.239 saveroads.ru. 86399 IN A 204.46.43.240 saveroads.ru. 86399 IN A 204.46.43.1 saveroads.ru. 86399 IN A 204.46.43.2 saveroads.ru. 86399 IN A 204.46.43.3 saveroads.ru. 86399 IN A 204.46.43.4 saveroads.ru. 86399 IN A 204.46.43.5 saveroads.ru. 86399 IN A 204.46.43.6 saveroads.ru. 86399 IN A 204.46.43.7 saveroads.ru. 86399 IN A 204.46.43.8 saveroads.ru. 86399 IN A 204.46.43.9 saveroads.ru. 86399 IN A 204.46.43.10 saveroads.ru. 86399 IN A 204.46.43.11 saveroads.ru. 86399 IN A 204.46.43.12 saveroads.ru. 86399 IN A 204.46.43.13 saveroads.ru. 86399 IN A 204.46.43.14 saveroads.ru. 86399 IN A 204.46.43.15 saveroads.ru. 86399 IN A 204.46.43.16 saveroads.ru. 86399 IN A 204.46.43.17 saveroads.ru. 86399 IN A 204.46.43.18 saveroads.ru. 86399 IN A 204.46.43.19 saveroads.ru. 86399 IN A 204.46.43.20 saveroads.ru. 86399 IN A 204.46.43.21 saveroads.ru. 86399 IN A 204.46.43.22 saveroads.ru. 86399 IN A 204.46.43.23 saveroads.ru. 86399 IN A 204.46.43.24 saveroads.ru. 86399 IN A 204.46.43.25 saveroads.ru. 86399 IN A 204.46.43.26 saveroads.ru. 86399 IN A 204.46.43.27 saveroads.ru. 86399 IN A 204.46.43.28 saveroads.ru. 86399 IN A 204.46.43.29 saveroads.ru. 86399 IN A 204.46.43.30 saveroads.ru. 86399 IN A 204.46.43.31 saveroads.ru. 86399 IN A 204.46.43.32 saveroads.ru. 86399 IN A 204.46.43.33 saveroads.ru. 86399 IN A 204.46.43.34 saveroads.ru. 86399 IN A 204.46.43.35 saveroads.ru. 86399 IN A 204.46.43.36 saveroads.ru. 86399 IN A 204.46.43.37 saveroads.ru. 86399 IN A 204.46.43.38 saveroads.ru. 86399 IN A 204.46.43.39 saveroads.ru. 86399 IN A 204.46.43.40 saveroads.ru. 86399 IN A 204.46.43.41 saveroads.ru. 86399 IN A 204.46.43.42 saveroads.ru. 86399 IN A 204.46.43.43 saveroads.ru. 86399 IN A 204.46.43.44 saveroads.ru. 86399 IN A 204.46.43.45 saveroads.ru. 86399 IN A 204.46.43.46 saveroads.ru. 86399 IN A 204.46.43.47 saveroads.ru. 86399 IN A 204.46.43.48 saveroads.ru. 86399 IN A 204.46.43.49 saveroads.ru. 86399 IN A 204.46.43.50 saveroads.ru. 86399 IN A 204.46.43.51 saveroads.ru. 86399 IN A 204.46.43.52 saveroads.ru. 86399 IN A 204.46.43.53 saveroads.ru. 86399 IN A 204.46.43.54 saveroads.ru. 86399 IN A 204.46.43.55 saveroads.ru. 86399 IN A 204.46.43.56 saveroads.ru. 86399 IN A 204.46.43.57 saveroads.ru. 86399 IN A 204.46.43.58 saveroads.ru. 86399 IN A 204.46.43.59 saveroads.ru. 86399 IN A 204.46.43.60 saveroads.ru. 86399 IN A 204.46.43.61 saveroads.ru. 86399 IN A 204.46.43.62 saveroads.ru. 86399 IN A 204.46.43.63 saveroads.ru. 86399 IN A 204.46.43.64 saveroads.ru. 86399 IN A 204.46.43.65 saveroads.ru. 86399 IN A 204.46.43.66 saveroads.ru. 86399 IN A 204.46.43.67 saveroads.ru. 86399 IN A 204.46.43.68 saveroads.ru. 86399 IN A 204.46.43.69 saveroads.ru. 86399 IN A 204.46.43.70 saveroads.ru. 86399 IN A 204.46.43.71 saveroads.ru. 86399 IN A 204.46.43.72 saveroads.ru. 86399 IN A 204.46.43.73 saveroads.ru. 86399 IN A 204.46.43.74 saveroads.ru. 86399 IN A 204.46.43.75 saveroads.ru. 86399 IN A 204.46.43.76 saveroads.ru. 86399 IN A 204.46.43.77 saveroads.ru. 86399 IN A 204.46.43.78 saveroads.ru. 86399 IN A 204.46.43.79 saveroads.ru. 86399 IN A 204.46.43.80 saveroads.ru. 86399 IN A 204.46.43.81 saveroads.ru. 86399 IN A 204.46.43.82 saveroads.ru. 86399 IN A 204.46.43.83 saveroads.ru. 86399 IN A 204.46.43.84 saveroads.ru. 86399 IN A 204.46.43.85 saveroads.ru. 86399 IN A 204.46.43.86 saveroads.ru. 86399 IN A 204.46.43.87 saveroads.ru. 86399 IN A 204.46.43.88 saveroads.ru. 86399 IN A 204.46.43.89 saveroads.ru. 86399 IN A 204.46.43.90 saveroads.ru. 86399 IN A 204.46.43.91 saveroads.ru. 86399 IN A 204.46.43.92 saveroads.ru. 86399 IN A 204.46.43.93 saveroads.ru. 86399 IN A 204.46.43.94 saveroads.ru. 86399 IN A 204.46.43.95 saveroads.ru. 86399 IN A 204.46.43.96 saveroads.ru. 86399 IN A 204.46.43.97 saveroads.ru. 86399 IN A 204.46.43.98 saveroads.ru. 86399 IN A 204.46.43.99 saveroads.ru. 86399 IN A 204.46.43.100 saveroads.ru. 86399 IN A 204.46.43.101 saveroads.ru. 86399 IN A 204.46.43.102 saveroads.ru. 86399 IN A 204.46.43.103 saveroads.ru. 86399 IN A 204.46.43.104 saveroads.ru. 86399 IN A 204.46.43.105 saveroads.ru. 86399 IN A 204.46.43.106 saveroads.ru. 86399 IN A 204.46.43.107 saveroads.ru. 86399 IN A 204.46.43.108 saveroads.ru. 86399 IN A 204.46.43.109 saveroads.ru. 86399 IN A 204.46.43.110 saveroads.ru. 86399 IN A 204.46.43.111 saveroads.ru. 86399 IN A 204.46.43.112 saveroads.ru. 86399 IN A 204.46.43.113 saveroads.ru. 86399 IN A 204.46.43.114 saveroads.ru. 86399 IN A 204.46.43.115 saveroads.ru. 86399 IN A 204.46.43.116 saveroads.ru. 86399 IN A 204.46.43.117 saveroads.ru. 86399 IN A 204.46.43.118 saveroads.ru. 86399 IN A 204.46.43.119 saveroads.ru. 86399 IN A 204.46.43.120 saveroads.ru. 86399 IN A 204.46.43.121 saveroads.ru. 86399 IN A 204.46.43.122 saveroads.ru. 86399 IN A 204.46.43.123 saveroads.ru. 86399 IN A 204.46.43.124 saveroads.ru. 86399 IN A 204.46.43.125 saveroads.ru. 86399 IN A 204.46.43.126 saveroads.ru. 86399 IN A 204.46.43.127 saveroads.ru. 86399 IN A 204.46.43.128 saveroads.ru. 86399 IN A 204.46.43.129 saveroads.ru. 86399 IN A 204.46.43.130 saveroads.ru. 86399 IN A 204.46.43.131 saveroads.ru. 86399 IN A 204.46.43.132 saveroads.ru. 86399 IN A 204.46.43.133 saveroads.ru. 86399 IN A 204.46.43.134 saveroads.ru. 86399 IN A 204.46.43.135 saveroads.ru. 86399 IN A 204.46.43.136 saveroads.ru. 86399 IN A 204.46.43.137 saveroads.ru. 86399 IN A 204.46.43.138 saveroads.ru. 86399 IN A 204.46.43.139 saveroads.ru. 86399 IN A 204.46.43.140 saveroads.ru. 86399 IN A 204.46.43.141 saveroads.ru. 86399 IN A 204.46.43.142 saveroads.ru. 86399 IN A 204.46.43.143 saveroads.ru. 86399 IN A 204.46.43.144 saveroads.ru. 86399 IN A 204.46.43.145 saveroads.ru. 86399 IN A 204.46.43.146 saveroads.ru. 86399 IN A 204.46.43.147 saveroads.ru. 86399 IN A 204.46.43.148 saveroads.ru. 86399 IN A 204.46.43.149 saveroads.ru. 86399 IN A 204.46.43.150 saveroads.ru. 86399 IN A 204.46.43.151 saveroads.ru. 86399 IN A 204.46.43.152 saveroads.ru. 86399 IN A 204.46.43.153 saveroads.ru. 86399 IN A 204.46.43.154 saveroads.ru. 86399 IN A 204.46.43.155 saveroads.ru. 86399 IN A 204.46.43.156 saveroads.ru. 86399 IN A 204.46.43.157 saveroads.ru. 86399 IN A 204.46.43.158 saveroads.ru. 86399 IN A 204.46.43.159 saveroads.ru. 86399 IN A 204.46.43.160 saveroads.ru. 86399 IN A 204.46.43.161 saveroads.ru. 86399 IN A 204.46.43.162 saveroads.ru. 86399 IN A 204.46.43.163 saveroads.ru. 86399 IN A 204.46.43.164 saveroads.ru. 86399 IN A 204.46.43.165 saveroads.ru. 86399 IN A 204.46.43.166 saveroads.ru. 86399 IN A 204.46.43.167 saveroads.ru. 86399 IN A 204.46.43.168 saveroads.ru. 86399 IN A 204.46.43.169 saveroads.ru. 86399 IN A 204.46.43.170 saveroads.ru. 86399 IN A 204.46.43.171 saveroads.ru. 86399 IN NS ns1.reg.ru. saveroads.ru. 86399 IN NS ns2.reg.ru. saveroads.ru. 86399 IN SOA ns1.reg.ru. hostmaster.ns1.reg.ru. 1390724397 14400 3600 604800 43200 ;; ADDITIONAL SECTION: ns1.reg.ru. 68069 IN A 31.31.204.37 ns1.reg.ru. 68069 IN A 31.31.204.52 ns1.reg.ru. 68069 IN A 31.31.205.39 ns1.reg.ru. 68069 IN A 31.31.205.55 ns1.reg.ru. 68069 IN A 31.31.205.73 ns1.reg.ru. 68069 IN A 31.31.204.25 ns1.reg.ru. 68069 IN AAAA 2a00:f940::25 ns2.reg.ru. 33770 IN A 88.212.207.122 ns2.reg.ru. 33770 IN A 31.31.205.74 ns2.reg.ru. 33770 IN A 31.31.205.56 ns2.reg.ru. 33770 IN A 198.100.149.22 ns2.reg.ru. 68069 IN AAAA 2a00:f940::37 -----iptablesレシピ----- -A uscom -p udp -m string --hex-string "|0000000000010973617665726f6164730272750000ff|" --algo bm --to 65535 --dport 53 -j DROP -m comment --comment "DROP DNS Q saveroads.ru IN ANY +ad udp" -A uscom -p udp -m string --hex-string "|0000000000000973617665726f6164730272750000ff|" --algo bm --to 65535 --dport 53 -j DROP -m comment --comment "DROP DNS Q saveroads.ru IN ANY -ad udp" fkfkfkfa.com -----iptablesレシピ----- -A uscom -p udp -m string --hex-string "|0100000000000108666b666b666b666103636f6d0000ff0001|" --algo bm --to 65535 --dport 53 -j DROP -m comment --comment "DROP DNS Q fkfkfkfa.com IN ANY +ad udp -A uscom -p udp -m string --hex-string "|0100000000000008666b666b666b666103636f6d0000ff0001|" --algo bm --to 65535 --dport 53 -j DROP -m comment --comment "DROP DNS Q fkfkfkfa.com IN ANY +noad udp fkfkfkfa.co.uk -----iptablesレシピ----- -A uscom -p udp -m string --hex-string "|0100000000000108666b666b666b666102636f02756b0000ff|" --algo bm --to 65535 --dport 53 -j DROP -m comment --comment "DROP DNS Q fkfkfkfa.co.uk IN ANY +ad udp" -A uscom -p udp -m string --hex-string "|0100000000000008666b666b666b666102636f02756b0000ff|" --algo bm --to 65535 --dport 53 -j DROP -m comment --comment "DROP DNS Q fkfkfkfa.co.uk IN ANY +noad udp" ----------------------------------------------------- 上記iptablesの設定で対象のクエリだけDROPすることは可能。 ただ、すぐにクエリの内容を変えてAttackしてくる。 iptablesのSTRINGの設定ができないのであれば、 対象Domainのnameserver宛のpacketをDROPすることで対処可能。 もちろんiptables設定後にcacheを削除する必要があるが。 ただしnameserver宛のpacketをDROPする際に注意しなければならないのは、 そのnameserverが対象以外のdomainを所持していた場合、 そのdomainも巻き添えになってしまうこと。 そろそろいい加減にしてくれとも思う。

JVN [Japan Vulnerability Notes]

Categoly

Posted dates

2014年1月
« 10月   4月 »
 1234
567891011
12131415161718
19202122232425
262728293031  

NEC Direct(NECダイレクト)

NEC Direct(NECダイレクト)