Comments on: New denial-of-service threat emerges

Attacks targeted 1,500 IP addresses and delivered a heftier blow than normal DOS threats, VeriSign security chief says.

[andrew999999999]

This is just PR for VeriSign

This is just a PR campaign by VeriSign to try to defend attacks about its new .com price hike agreement:
http://domainnamewire.com/2006/03/16/verisign-spin-machine-moves-into-high-gear/

[Seaspray0]

Wrong

It's a story about a new type of DOS attack. Since the attack goes through DNS servers, it is related to verisign as they are in the business of providing DNS services to the internet. The story, in no way, is good information about verisign as they currently have no way of stopping this type of attack, so how can you claim it PR?

[Jeremiah256]

ISN'T THIS OLD

Correct me if I'm wrong but isn't this just DR-DOS - Distributed Reflection Denial Of Service? It's been documented since at least 2002. Search around Steve Gibson's website (http://grc.com). He documents how he upset some kid and got blasted off the net by a DR-DOS attack using some of the internet's most power servers.

[wbenton]

What ever happened to 3-way handshakes?

DNS replies are returned to DNS requests. Thus if the requester drops anything that doesn't match the 3-way handshake... the problem can be staved off.

3-way handshaking has been around for quite a few years now and thus it's nothing new... except for those whom have yet to implement it.

Thus even if you receive a DNS reply which you didn't ask for... 3-way handshaking should drop the packet because it wasn't requested... even if it's from your own DNS server!

Walt

[Jeremiah256]

RE: THREE WAY HANDSHAKE

Someone correct me if I'm wrong but I think the problem is the amount of packets sent to your site. If your site drops it and the DNS server doesn't receive a response, correct me if I'm wrong, it'll try again a few more times assuming the packet was dropped. These people are collecting the address of vast numbers of DNS servers (and other servers) and will spoof your site at all of them. It becomes a bandwidth issue.