An enterprise network security team notices an unexpected influx of inbound UDP traffic targeted at the organization's public web server IP address. Packet captures reveal that the incoming traffic consists of large, unsolicited DNS response payloads originating from various external open resolver servers on UDP port 53. Further investigation indicates that the web server itself never initiated any corresponding DNS queries. Which of the following attack types and mechanisms is actively occurring?
- A DNS amplification attack, where the adversary sends queries with a spoofed source IP address to open resolvers to reflect enlarged responses onto the target.Cevap
- BA DNS cache poisoning attack, where the adversary spoofs ARP replies on the target subnet to redirect legitimate DNS queries to a malicious resolver.
- CA TCP SYN flood attack, where the adversary uses DNS port 53 over connection-oriented TCP to overwhelm state tables on the perimeter firewall.
- DA DNS resource exhaustion attack, where malicious CNAME record queries flood the local authoritative server to exhaust its storage buffers.
Cevap
A DNS amplification attack, where the adversary sends queries with a spoofed source IP address to open resolvers to reflect enlarged responses onto the target.
The correct answer accurately identifies a DNS amplification attack. In this attack vector, the threat actor sends DNS requests (often requesting ANY or TXT records via EDNS0 extension) to publicly accessible open DNS resolvers while spoofing the source IP address to match the target victim. Because UDP is connectionless, the resolvers send their large response packets directly to the victim, resulting in volumetric denial of service.
Adım Adım Çözüm
Anahtar Kavram
DNS Amplification Attack Vector and IP Spoofing Reflection