[nsp-sec] High DNS load in germany (UPDATE)

Tom Daly tom at dyn.com
Mon Jan 11 12:30:40 EST 2010


Peter,
What's the IPs for your authoritative boxes? We'll check our recursives.

Tom

Sent from my handheld; please excuse typos and spelling mistakes.

-----Original Message-----

From: <P.Quick at telekom.de>
Sent: Mon, 11 Jan 2010 9:18:26 AM America/Los_Angeles
To: nsp-security at puck.nether.net
Subject: Re: [nsp-sec] High DNS load in germany (UPDATE)


----------- nsp-security Confidential --------

Hi all,

At the weekend be got hit by another high load against our DNS :(
(Saturday and Sunday between 18:00 and 20:30 (UTC+1)

Again it was just in-addr.arpa queries (reverse lookups) from all over the world.

On my point of view, this high load is not realy an attack, but a side-effect
 from malicious traffic from our own customer. (maybe portscans or sending SPAM).

So what i'm thinking about the scenario:
- many of our customers are infected by a new malware
- they are used for distributing SPAM or to portscanning to IP-Addresses all over the world
- The target mailservers or attacked hosts make a reverse-lookup to the attacking 
   ip-address (our customer)
- this produced a high load at our DNS for the hugh number of in-addr.arpa queries.


But again, this is only a assumption from my side.

Does anybody have a idea, how we can verify if this scenario is realy the 
 reason for the 700% rise of in-addr.arpa queries against our DNS ??

It's look like most of the queries are comming from the DNS-resolver from 
 ISPs all over the world. 

Because we see only the DNS Server in your network, it's impossible for us to 
 say anything about the real source of the in-addr.arpa queries.
 So one question is, if this queries are produced by a small number of clients or if 
 a lot of systems produce this queries.
 If it's only a small number of sources, maybe we can find out, if there is
 another reason for this high number of in-addr.arpa queries.

Does anybody from you have the possibility to trace the real sources of in-addr.arpa queries
 towards AS3320 ??? 
 Any help is realy welcome :)

Greetings, 
Peter



PS:
By analysing the DNS traffic, we think we have found 2 DNS from ThePlanet.com,
 which are not right configured => no cache function.
Is someone from ThePlanet.com is on the list, maybe he can take a look at this DNS:)




Nameserver defekt Nr. 1.)
162.74.85.70.in-addr.arpa. 86400 IN     PTR     a2.4a.5546.static.theplanet.com.
; <<>> DiG 9.4.3-P3 <<>> @70.85.74.162 version.bind ch txt
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1050
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;version.bind.                  CH      TXT

;; ANSWER SECTION:
version.bind.           0       CH      TXT     "54-68-69-73-20-73-70-61-63-65-20-69-6E-74-65-6E-74-69-6F-6E-61-6C-6C-79-20-6C-65-66-74-20-62-6C-61-6E-6B" ""

;; AUTHORITY SECTION:
version.bind.           0       CH      NS      version.bind.

;; ADDITIONAL SECTION:
ServerReturned.Answer.  50      IN      A       192.58.128.30

;; Query time: 168 msec
;; SERVER: 70.85.74.162#53(70.85.74.162)
;; WHEN: Sat Jan  9 17:26:20 2010
;; MSG SIZE  rcvd: 235


Nameserver defekt Nr. 2.)
226.138.84.70.in-addr.arpa. 86400 IN    PTR     e2.8a.5446.static.theplanet.com.
; <<>> DiG 9.4.3-P3 <<>> @70.84.138.226 version.bind ch txt
; (1 server found)
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 594
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; QUESTION SECTION:
;version.bind.                  CH      TXT

;; ANSWER SECTION:
version.bind.           0       CH      TXT     "39-2E-36-2E-31-2D-50-31" ""

;; AUTHORITY SECTION:
version.bind.           0       CH      NS      version.bind.

;; ADDITIONAL SECTION:
ServerReturned.Answer.  50      IN      A       192.228.79.201

;; Query time: 205 msec
;; SERVER: 70.84.138.226#53(70.84.138.226)
;; WHEN: Sat Jan  9 17:25:36 2010
;; MSG SIZE  rcvd: 154




Mit freundlichen Gr??en 
Peter Quick 


Deutsche Telekom AG 
Service Zentrale, Group IT Security 
Peter Quick 
SZT-1 
Karl-Lange Strasse 29, 44791 Bochum 
+49 234 505 7800 (Tel.) 
+49 2151 3660 4770 (Fax) 
+49 160 7083944 (Mobil) 
E-Mail: p.quick at telekom.de 
http://www.telekom.com 

Erleben, was verbindet.

Deutsche Telekom AG 
Aufsichtsrat: Prof. Dr. Ulrich Lehner (Vorsitzender) 
Vorstand: Ren? Obermann (Vorsitzender),
Hamid Akhavan, Dr. Manfred Balz, Reinhard Clemens, Niek Jan van Damme,
Timotheus H?ttges, Guido Kerkhoff, Thomas Sattelberger 
Handelsregister: Amtsgericht Bonn HRB 6794 
Sitz der Gesellschaft: Bonn 
WEEE-Reg.-Nr.: DE50478376




-----Urspr?ngliche Nachricht-----
Von: nsp-security-bounces at puck.nether.net [mailto:nsp-security-bounces at puck.nether.net] Im Auftrag von Quick, Peter
Gesendet: Donnerstag, 7. Januar 2010 18:54
An: nsp-security at puck.nether.net
Betreff: [nsp-sec] High DNS load in germany

----------- nsp-security Confidential --------

Hello nsp-sec,

During the last days, there are a lot of  reports, that serveral german ISPs 
 have massiv problems with their DNS systems. 
 Major outages were reportet (eg.  1und1, InterntX, schlund,)
 example: http://www.h-online.com/security/news/item/Attack-on-InterNetX-s-DNS-servers-898190.html

Since yesterday we also monitor a 500% increase  of traffic 
 towards our authorised DNS. (till now we don't have any customer impact)
 (mostly against dns01.btx.dtag.de and dns04.btx.dtag.de).

The hugh traffic is only temporary and from serveral sources all over the world.

I have tried to find some information, what coulde be the reason for this big 
 traffic increas.
 Because of this i found the statistic-site from DENIC, about the 
 performace of the k-root-server of the DENIC.
 http://k.root-servers.org/statistics/ROOT/recursion.html
 There you can also seen an hugh increas of Recursion Requests since december.
 (about 700%, also only temporary)

Does anybony see the same traffic-increase and does anybody know
 whats the reason for that ?

In the moment i try to get in contact to other german ISP.
 But my personal contacts didn't responde since now.
 So if anybody from 1und1, schlund, InterntX ... is on the list 
 and is interest in sharing some information about this issue,
 feel free to contact me offline.


Greetings,
Peter Quick 


Deutsche Telekom AG 
Service Zentrale, Group IT Security 
Peter Quick 
SZT-1 
Karl-Lange Strasse 29, 44791 Bochum 
+49 234 505 7800 (Tel.) 
+49 2151 3660 4770 (Fax) 
+49 160 7083944 (Mobil) 
E-Mail: p.quick at telekom.de 
http://www.telekom.com 

Erleben, was verbindet.

Deutsche Telekom AG 
Aufsichtsrat: Prof. Dr. Ulrich Lehner (Vorsitzender) 
Vorstand: Ren? Obermann (Vorsitzender),
Hamid Akhavan, Dr. Manfred Balz, Reinhard Clemens, Niek Jan van Damme,
Timotheus H?ttges, Guido Kerkhoff, Thomas Sattelberger 
Handelsregister: Amtsgericht Bonn HRB 6794 
Sitz der Gesellschaft: Bonn 
WEEE-Reg.-Nr.: DE50478376






_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________


_______________________________________________
nsp-security mailing list
nsp-security at puck.nether.net
https://puck.nether.net/mailman/listinfo/nsp-security

Please do not Forward, CC, or BCC this E-mail outside of the nsp-security
community. Confidentiality is essential for effective Internet security counter-measures.
_______________________________________________



More information about the nsp-security mailing list