Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.

View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 
2010 posts

Uber Geek
+1 received by user: 272

Trusted
Subscriber

  Reply # 711375 3-Nov-2012 14:01 Send private message

Cloudflare had an interesting article on something similar a few days ago:

http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack



75 posts

Master Geek


  Reply # 711376 3-Nov-2012 14:07 Send private message

insane: Cloudflare had an interesting article on something similar a few days ago:

http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack


Well that's interesting considering the IP I was hitting is a Cloudfare one. Cheers for the link.

BDFL
49934 posts

Uber Geek
+1 received by user: 4624

Administrator
Trusted
Geekzone
Subscriber

  Reply # 711380 3-Nov-2012 14:16 Send private message

I was just going to post about this. Just going back to the OP post:


mattie47: This is probably a pretty grey area, and probably something ISPs normally wouldn't have to deal with, other than customers ringing up complaining about why their data usage is through the roof when they haven't been doing anything.



mattie47:
mattie47: I also have an internal DNS server, but port 53 isn't forwarded from the firewall.


Wow I take that back. I was looking at my port forwarding rules which didn't show 53 anywhere so presumed was closed. I just did a capture on the internal NIC which showed the same traffic. This got me worried. A quick online port check showed 53 as open (what?).

Having a look again around PFSense showed there's a DNS forwarder page I must have skimmed over. Turns out I had "Enable DNS forwarder" ticked. Okay, that's port 53 traffic going to internal now dropped...


Now, a couple of comments, and please don't take it personally...

When running a network service the admin should not "skim over". Any open port with forward traffic may attract unsolicited "visitors". If the service is somehow valuable for them they will use it.

In this situation the service on port 53 can be easily used for a DDoS attack. Even if you don't have an infected computer in your network your devices are still active participants in attacks by simply offering the services and acting on requests from unauthorised users. That's the point above with the link to the DNS amplification attack as described by CloudFlare.

In this case I have to say Slingshot was REALLY NICE to you. The usage was not an error in their systems and they should have every right to charge your account for that. I'm pretty sure in their T&Cs somewhere there'll be a clause saying you're responsible for keeping your connection safe - that means not only safe from malware, but safe from unauthorised access and usage. Running a service and leaving it open it's not their problem, really.

That blog you link in the OP... That guy didn't get the "amplification" part of the attack. He seems to think the attack is directed at him, not at the response from his DNS to the spoofed IP.

Go read the Cloudflare blog again. Secure your network. Make sure to use an external scanner to identify any open ports/active services still lurking (Try GRC ShieldsUP!.

Changing IP addresses without making sure your vulnerabilities aren't protect won't save your bandwidth, as those idiots will find your network again pretty soon - port scanners are capable of going around entire IP blocks very quickly.








3015 posts

Uber Geek
+1 received by user: 197

Trusted
Subscriber

  Reply # 711695 4-Nov-2012 12:09 Send private message

Hi Mattie,
Looking at your PFsense rules you have an allow all on the WAN. The way firewall rules work on PFsense is that the first rule it find that matches is applied. So the rules you have underneath that don't count at all. It definitely sounds like you are thus being used as an open relay.

What you should do is delete that first rule for allow all. Put your allow rules in place e.g. RDP, HTTP etc. then put a deny all underneath those.


Also, I believe because you are using private address space for your LAN, you should set your destination for the allow rules to be your WAN interface rather than 192.168.XX.XX.





1 | 2 
View this topic in a long page with up to 500 replies per page Create new topic




Twitter »
Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





Trending now »

Hot discussions in our forums right now:

Speed limit when overtaking? Teach me please.
Created by nakedmolerat, last reply by Shadowfoot on 24-Oct-2014 20:33 (63 replies)
Pages... 3 4 5


House Auctions
Created by t0ny, last reply by meesham on 24-Oct-2014 20:17 (26 replies)
Pages... 2


Neon - Sky's new streaming service
Created by JarrodM, last reply by compost on 24-Oct-2014 20:49 (17 replies)
Pages... 2


Spark Socialiser
Created by freitasm, last reply by freitasm on 22-Oct-2014 18:39 (34 replies)
Pages... 2 3


30 too old to get into IT?
Created by Interslice, last reply by shk292 on 24-Oct-2014 20:39 (16 replies)
Pages... 2


American legal jurisdiction in New Zealand
Created by ajobbins, last reply by gzt on 21-Oct-2014 14:58 (30 replies)
Pages... 2


iPad Air 2 and iPad Mini 3. Gonna get one?
Created by Dingbatt, last reply by Paul1977 on 24-Oct-2014 11:16 (107 replies)
Pages... 6 7 8


5Ghz AP recommendations?
Created by ubergeeknz, last reply by sbiddle on 24-Oct-2014 12:42 (12 replies)


Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.