From: Paul Vixie <vixie@vix.com>

mike@sentex.net (Mike Tancsa) writes:

...

... Still, I think the softest targets are the root name servers. I was glad to hear at the Toronto NANOG meeting that this was being looked into from a routing perspective. Not sure what is being done from a DoS perspective.

I think the gtld-servers.net are the target for a globally disruptive and prolonged DDoS. Servers doing reverse lookup might also be targets in more specialised attacks, as their disruption would be continent wide rather than merely country wide (like most forward look ups). Paul obviously has the experience to tell me if I'm crazy, but I would guess the "." zone probably isn't that large in absolute terms, so large ISPs (NANOG members ?) could arrange for their recursive servers to act as private secondaries of ".", thus eliminating the dependence on the root servers entirely for a large chunks of the Internet user base. To set up such a backup plan during a DDoS against the root name servers might be challenging, but it isn't impossible, it would also stop large ISPs DNS servers forwarding daft queries onto the root DNS servers, thus lowering the load on the root-servers when they need it most! So whilst the root servers make the obvious target they are also in some ways a relatively easy target to move, or expand in number. I think private secondaries are a better bet than new root servers, as that would require trusting less experienced admins with all of the Internet's DNS, rather than just ISP users trusting their ISP (which they do implicitly already). I think the kinds of zones being handled by the gtld-servers would be harder to relocate, if only due to size, although the average NANOG reader probably has rather more bandwidth available than I do, they may not have the right kind of spare capacity on their DNS servers to secondary ".com" at short notice.

Now that we've seen enough years of experience from Genuity.orig, UltraDNS, Nominum, AS112, and {F,K}.root-servers.net, we're seriously talking about using anycast for the root server system.

We have even more experience at zone transfers with DNS, and it doesn't require complicating anything lower than layer 7, which has an appeal to me, and I suspect most ISPs who probably have enough trouble keeping BGP in order. All I think root server protection requires is someone with access to the relevant zone to make it available through other channels to large ISPs. There is no technical reason why key DNS infrastructure providers could not implement such a scheme on their own recursive DNS servers now, and it would offer to reduce load on both their own, and the root DNS servers and networks. Other DNS admins could change their caching servers to forward to their ISPs name servers - and whilst forwarding might be frowned on by the DNS community, the hierarchical caching model is typically faster than the current approach, and more scalable, if potentially less secure (poisoning of a tier in the hierarchy is bad news - theoretically we lose some redundancy, although forward-first might address that, and some current DNS server implementations do not support this model as well as they could - undoubtably such a scheme would lead to more small disruptions but presumably avoid the "one big one" being discussed). The single limiting factor on implementing such an approach would be DNS know-how, as whilst it is probably a two line change for most DNS servers to forward to their ISPs DNS server (or zone transfer "."), many sites probably lack the inhouse skills to make that change at short notice. In practical terms I'd be more worried about smaller attacks against specific CC domains, I could imagine some people seeing disruption of "il" as a more potent (and perhaps less globally unpopular) political statement, than disrupting the whole Internet. Similarly an attack on a commercial subdomain in a specific country could be used to make a political statement, but might have significant economic consequences for some companies. Attacking 3 or 4 servers is far easier than attacking 13 geographically diverse, well networked, and well protected servers. Similarly I think many CC domains, and country based SLD are far more "hackable" than many people realised due to the extensive use of out of bailiwick data, as described by DJB. At some point the script kiddies will realise they can "own" a country or two instead of one website, by hacking one DNS server, and the less well secured DNS servers will all go in a week or two.