Spamhaus CIO calls for those running open DNS resolvers to be fined

Posted by   Virus Bulletin on   Nov 29, 2013

Open DNS resolvers instrumental in many DDoS attacks.

At the Cyber Security Summit in London, Richard Cox, CIO of DNS blacklist provider Spamhaus, called on the UK government to issue fines to those running open DNS resolvers, PC Pro writes.

Open DNS resolvers have become an important tool for those performing DDoS attacks. Attackers send many small DNS requests, crafted so that they will generate a relatively large response, to open resolvers. The source addresses of the requests are forged to be that of the target, which will then see a very large volume of DNS responses sent to its network.

In this way, attackers can generate very large attacks with relatively few resources. There are few organizations that know as well as Spamhaus how big a problem this can be: Spamhaus was the target of a massive DDoS attack earlier this year.

As CloudFlare's John Graham-Cumming pointed out during his VB2013 presentation on open DNS resolvers, this is not the first time that the open nature of Internet servers has been abused to perform attacks. In the late 1990s, open SMTP relays were just as big a problem: they made it possible to send large amounts of spam through someone else's server. Indeed, Spamhaus was originally set up to list the IP addresses of such open relays.

I agree with Cox that something needs to be done about the large number of open DNS resolvers ready to attack the Internet - though whether governments issuing fines is the solution, I am not so sure.

Firstly, the international nature of the Internet means that a handful of governments making something illegal will have little effect on the Internet as a whole. Secondly, I worry that government regulation of DNS servers will be used as a stepping stone for ill-advised proposals such as PIPA and SOPA.

But that doesn't mean nothing can be done. To my best of knowledge, running an open SMTP relay is still legal. Yet very few are doing so, and thanks to the hard work put in by Spamhaus and others in the anti-spam community, those that do so will see very few of the emails they send actually delivered.

Posted on 29 November 2013 by Martijn Grooten



Latest posts:

VB2019 paper: Operation Soft Cell - a worldwide campaign against telecommunication providers

Today we publish the VB2019 paper by Cybereason researchers Mor Levi, Amit Serper and Assaf Dahan on Operation Soft Cell, a targeted attack against telecom providers around the world.

VB2019 paper: A study of Machete cyber espionage operations in Latin America

At VB2019 in London a group of researchers from the Stratosphere Lab at the Czech Technical University in Prague presented a paper in which they analysed and dissected the cyber espionage activities of an APT group in Latin America through the…

VB2019 paper: The push from fiction for increased surveillance, and its impact on privacy

In a paper presented at VB2019 in London, researchers Miriam Cihodariu (Heimdal Security) and Andrei Bogdan Brad (Code4Romania) looked at how surveillance is represented in fiction and how these representations are shaping people's attitudes to…

VB2019 paper: Oops! It happened again!

At VB2019 in London industry veterans Righard Zwienenberg and Eddy Willems took a detailed look at the relationship between past and current cyber threats. Today, we publish both their paper and the recording of their presentation.

Job vacancy at VB: Security Evangelist

Virus Bulletin is recruiting for a person to be the public face of the company

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.