[GTER] DDoS DNS Reflection attack
Alexandre J. Correa (Onda)
alexandre at onda.net.br
Sun Jun 26 23:39:52 -03 2016
As 4:00 começamos a receber um ataque na ordem de 24 gbit/s em nossos
roteadores de borda.
Provenientes de "DNS Reflection".
Conseguimos mitigar uma parte, a outra (que chega por outra operadora)
somente com BH via community...
examinamos o conteúdo dos pacotes e SEMPRE aparece commerce.gov conforme
uma amostra abaixo:
23:24:25.952121 IP 112.202.241.172.10003 > xxx.xxx.xxx.xxx:5555 UDP,
length 1207
0x0000: 0066 0800 4500 04d3 ed8a 4000 f011 69b9 .f..E..... at ...i.
0x0010: 70ca f1ac bd54 0f0a 2713 15b3 04bf cc2f p....T..'....../
0x0020: 599d 8180 0001 000b 0000 0009 0863 6f6d Y............com
0x0030: 6d65 7263 6503 676f 7600 00ff 0001 c00c merce.gov.......
0x0040: 0002 0001 0000 1fba 0016 0864 6e73 7365 ...........dnsse
0x0050: 6331 3007 6461 7461 6d74 6e03 636f 6d00 c10.datamtn.com.
0x0060: c00c 0002 0001 0000 1fba 000a 0764 6e73 .............dns
0x0070: 7365 6337 c033 c00c 0002 0001 0000 1fba sec7.3..........
0x0080: 000a 0764 6e73 7365 6339 c033 c00c 0002 ...dnssec9.3....
0x0090: 0001 0000 1fba 000b 0864 6e73 7365 6331 .........dnssec1
0x00a0: 31c0 33c0 0c00 0200 0100 001f ba00 0f08 1.3.............
0x00b0: 6863 6862 656e 7331 0364 6f63 c015 c00c hchbens1.doc....
0x00c0: 0002 0001 0000 1fba 000a 0767 7061 656e ...........gpaen
0x00d0: 7332 c098 c00c 002e 0001 0000 1fba 0120 s2..............
0x00e0: 0002 0802 0000 2a30 577b f4a6 5754 63b9 ......*0W{..WTc.
0x00f0: 24c3 0863 6f6d 6d65 7263 6503 676f 7600 $..commerce.gov.
0x0100: 07f9 ef54 ccd3 9cce 8e19 72cf e69b 521c ...T......r...R.
0x0110: fe9e 3d2b 0b6c ec01 5f3f e4c6 9473 ab1a ..=+.l.._?...s..
0x0120: cbbf 0aee 7103 08cc 16d2 365b 5499 ea76 ....q.....6[T..v
0x0130: ee2e ab6d 60c5 063f 2036 607e 2522 0485 ...m`..?.6`~%"..
0x0140: a330 3cf8 530f 1fa2 ec50 fe26 8776 3165 .0<.S....P.&.v1e
0x0150: 0fb6 34bf fd95 2b14 e040 b614 2cd9 4f56 ..4...+.. at ..,.OV
0x0160: 4568 831c 749d 2e8d 1ae7 b2dd a1e1 8f48 Eh..t..........H
0x0170: e8dd 2fc3 ef35 fc81 0884 aa4a d485 9cf5 ../..5.....J....
0x0180: ec86 ec55 cd51 9c21 c0f6 9fe4 ecca 1804 ...U.Q.!........
0x0190: b2e9 69b9 3b41 f952 fe73 a5e7 350a 8c8c ..i.;A.R.s..5...
0x01a0: 3390 2d44 4e08 bed4 e7d1 4627 e511 8b6d 3.-DN.....F'...m
0x01b0: deda 89b7 3ac0 ce30 a7cd fc2b 7687 2086 ....:..0...+v...
0x01c0: 94ca 4d5f 8555 974e c280 ed02 df8f 9b70 ..M_.U.N.......p
0x01d0: c793 e050 3a1a 38ea 9b8b 0d21 e334 a7cd ...P:.8....!.4..
0x01e0: 725e 2cda 8c59 a6ae b760 4149 8260 e738 r^,..Y...`AI.`.8
0x01f0: 043d f86a c84a 77e6 a0a2 f034 ab7a c38f .=.j.Jw....4.z..
0x0200: c00c 002e 0001 0000 1fba 0120 0002 0802 ................
0x0210: 0000 2a30 577b f4a6 5754 63b9 378c 0863 ..*0W{..WTc.7..c
0x0220: 6f6d 6d65 7263 6503 676f 7600 368c 534c ommerce.gov.6.SL
0x0230: be3b 873a 521f 2ef4 71ec e8b7 bf56 b573 .;.:R...q....V.s
0x0240: ac64 3cd7 33a7 9fe0 967d 0c64 aa00 36d9 .d<.3....}.d..6.
0x0250: 725f 1f2f 0a67 2836 0368 5e0d 26d5 db96 r_./.g(6.h^.&...
0x0260: f1e6 fe99 a372 29cc 3138 1abe 3118 750f .....r).18..1.u.
0x0270: bd6f 31d5 52e7 fbc1 b70a ce97 e4b3 03e6 .o1.R...........
0x0280: 50bc d158 ccf3 cb0b 02de c566 2395 1b7c P..X.......f#..|
0x0290: ca4d 83d4 7dd8 259b fd79 2f2f d2d5 a4e0 .M..}.%..y//....
0x02a0: 73ae d764 a15f f55c 4622 4bd2 3f00 0c17 s..d._.\F"K.?...
0x02b0: 2079 7f77 ad39 d117 e4ee 3301 da12 1441 .y.w.9....3....A
0x02c0: 6b59 9cde 2f9a b189 2d52 5239 2f6d ac7d kY../...-RR9/m.}
0x02d0: 496a 08ab 9512 f29c fff6 5120 5ede 4746 Ij........Q.^.GF
0x02e0: d8db 7d95 756f 9515 a510 470e e3f2 b3fc ..}.uo....G.....
0x02f0: 929a fe7b 2ed1 17b8 5354 a767 e507 2a68 ...{....ST.g..*h
0x0300: 2a06 6ccc 4562 57c6 49c4 f39e 329c e04d *.l.EbW.I...2..M
0x0310: c525 463f c59a 5ab0 94b1 aae2 060f e5b9 .%F?..Z.........
0x0320: 671c 909b 434c 6024 4833 ee61 c00c 002b g...CL`$H3.a...+
0x0330: 0001 0000 0399 0018 c997 0801 a5b3 b240 ...............@
0x0340: bf01 7c9c 91d7 0478 ce10 2c10 30bb 6b38 ..|....x..,.0.k8
0x0350: c00c 002b 0001 0000 0399 0024 c997 0802 ...+.......$....
0x0360: 59d0 39bf 0233 c6d7 e440 659c b427 7222 Y.9..3... at e..'r"
0x0370: 7d23 beb8 3540 06c4 f8db e742 342c 335d }#..5 at .....B4,3]
0x0380: c00c 002e 0001 0000 0399 0097 002b 0802 .............+..
0x0390: 0000 0e10 5779 8d47 5770 52c7 6827 0367 ....Wy.GWpR.h'.g
0x03a0: 6f76 002f 9678 9132 5013 47e5 91ff 45eb ov./.x.2P.G...E.
0x03b0: c2e2 d616 583f 434c 5ce8 949c 9bb8 19cf ....X?CL\.......
0x03c0: 608f 5cee 8e90 a7ce c6ae 3840 6d02 3910 `.\.......8 at m.9.
0x03d0: eb59 03d3 f59e 45ce bf62 bb78 5bbf abab .Y....E..b.x[...
0x03e0: 9ed7 1ef6 c761 8fd9 72af 5a18 e100 36b5 .....a..r.Z...6.
0x03f0: f474 beda b1b5 d5b2 15ff 46d7 5526 d70a .t........F.U&..
0x0400: 7ce3 d539 b962 84ab c5cc c607 a6c6 311a |..9.b........1.
0x0410: 25fd 34de 3b69 ec36 e7b9 f94a 7a56 9de9 %.4.;i.6...JzV..
0x0420: cea8 14c0 4c00 0100 0100 0017 5a00 04c0 ....L.......Z...
0x0430: c657 f2c0 4c00 1c00 0100 0017 5a00 1026 .W..L.......Z..&
0x0440: 0756 0001 4300 0010 0000 0000 0001 01c0 .V..C...........
0x0450: 6200 0100 0100 0017 5a00 044c 4912 eec0 b.......Z..LI...
0x0460: 6200 1c00 0100 0017 5a00 1020 0149 f0a0 b.......Z....I..
0x0470: 2a10 0000 0000 0000 0002 38c0 aa00 0100 *.........8.....
0x0480: 0100 00c9 1f00 04aa 6ee1 0dc0 aa00 1c00 ........n.......
0x0490: 0100 0020 e400 1026 1000 2000 0000 200d .......&........
0x04a0: 0c09 0c02 2502 23c0 2a00 0100 0100 0298 ....%.#.*.......
0x04b0: 0c00 046c a6aa 68c0 7800 0100 0100 01e6 ...l..h.x.......
0x04c0: e300 0440 3ec8 93c0 8f00 0100 0100 013f ...@>..........?
0x04d0: 7300 04aa 6ee1 0b s...n..
Alguém conhece este 'padrão' ou tem alguma dica ?
--
Sds.
Alexandre Jeronimo Correa
Onda Internet
Office: +55 34 3351 3077
www.onda.net.br
More information about the gter
mailing list