Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
View this topic in a long page with up to 500 replies per page Create new topic
1 | 2 
2275 posts

Uber Geek
+1 received by user: 364

Trusted
Subscriber

  Reply # 711375 3-Nov-2012 14:01
Send private message

Cloudflare had an interesting article on something similar a few days ago:

http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack



79 posts

Master Geek
+1 received by user: 1


  Reply # 711376 3-Nov-2012 14:07
Send private message

insane: Cloudflare had an interesting article on something similar a few days ago:

http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack


Well that's interesting considering the IP I was hitting is a Cloudfare one. Cheers for the link.

BDFL - Memuneh
60801 posts

Uber Geek
+1 received by user: 11681

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 711380 3-Nov-2012 14:16
Send private message

I was just going to post about this. Just going back to the OP post:


mattie47: This is probably a pretty grey area, and probably something ISPs normally wouldn't have to deal with, other than customers ringing up complaining about why their data usage is through the roof when they haven't been doing anything.



mattie47:
mattie47: I also have an internal DNS server, but port 53 isn't forwarded from the firewall.


Wow I take that back. I was looking at my port forwarding rules which didn't show 53 anywhere so presumed was closed. I just did a capture on the internal NIC which showed the same traffic. This got me worried. A quick online port check showed 53 as open (what?).

Having a look again around PFSense showed there's a DNS forwarder page I must have skimmed over. Turns out I had "Enable DNS forwarder" ticked. Okay, that's port 53 traffic going to internal now dropped...


Now, a couple of comments, and please don't take it personally...

When running a network service the admin should not "skim over". Any open port with forward traffic may attract unsolicited "visitors". If the service is somehow valuable for them they will use it.

In this situation the service on port 53 can be easily used for a DDoS attack. Even if you don't have an infected computer in your network your devices are still active participants in attacks by simply offering the services and acting on requests from unauthorised users. That's the point above with the link to the DNS amplification attack as described by CloudFlare.

In this case I have to say Slingshot was REALLY NICE to you. The usage was not an error in their systems and they should have every right to charge your account for that. I'm pretty sure in their T&Cs somewhere there'll be a clause saying you're responsible for keeping your connection safe - that means not only safe from malware, but safe from unauthorised access and usage. Running a service and leaving it open it's not their problem, really.

That blog you link in the OP... That guy didn't get the "amplification" part of the attack. He seems to think the attack is directed at him, not at the response from his DNS to the spoofed IP.

Go read the Cloudflare blog again. Secure your network. Make sure to use an external scanner to identify any open ports/active services still lurking (Try GRC ShieldsUP!.

Changing IP addresses without making sure your vulnerabilities aren't protect won't save your bandwidth, as those idiots will find your network again pretty soon - port scanners are capable of going around entire IP blocks very quickly.








3395 posts

Uber Geek
+1 received by user: 397

Trusted

  Reply # 711695 4-Nov-2012 12:09
Send private message

Hi Mattie,
Looking at your PFsense rules you have an allow all on the WAN. The way firewall rules work on PFsense is that the first rule it find that matches is applied. So the rules you have underneath that don't count at all. It definitely sounds like you are thus being used as an open relay.

What you should do is delete that first rule for allow all. Put your allow rules in place e.g. RDP, HTTP etc. then put a deny all underneath those.


Also, I believe because you are using private address space for your LAN, you should set your destination for the allow rules to be your WAN interface rather than 192.168.XX.XX.





1 | 2 
View this topic in a long page with up to 500 replies per page Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Microsoft Dynamics 365 Business Central launches
Posted 10-Jul-2018 10:40


Spark completes first milestone in voice platform upgrade
Posted 10-Jul-2018 09:36


Microsoft ices heated developers
Posted 6-Jul-2018 20:16


PB Technologies charged for its extended warranties and warned for bait advertising
Posted 3-Jul-2018 15:45


Almost 20,000 people claim credits from Spark
Posted 29-Jun-2018 10:40


Cove sells NZ's first insurance policy via chatbot
Posted 25-Jun-2018 10:04


N4L helping TAKA Trust bridge the digital divide for Lower Hutt students
Posted 18-Jun-2018 13:08


Winners Announced for 2018 CIO Awards
Posted 18-Jun-2018 13:03


Logitech Rally sets new standard for USB-connected video conference cameras
Posted 18-Jun-2018 09:27


Russell Stanners steps down as Vodafone NZ CEO
Posted 12-Jun-2018 09:13


Intergen recognised as 2018 Microsoft Country Partner of the Year for New Zealand
Posted 12-Jun-2018 08:00


Finalists Announced For Microsoft NZ Partner Awards
Posted 6-Jun-2018 15:12


Vocus Group and Vodafone announce joint venture to accelerate fibre innovation
Posted 5-Jun-2018 10:52


Kogan.com to launch Kogan Mobile in New Zealand
Posted 4-Jun-2018 14:34


Enable doubles fibre broadband speeds for its most popular wholesale service in Christchurch
Posted 2-Jun-2018 20:07



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.