Lately I've been seeing some traffic for this directedat.asia domain. Normally it is not reported as an attack as it tends to stay under my 'attack' threshold, which is a x amount of request per y minutes.
What is in a domain name? directed at asia -funny.
The IPs observed requesting / being attacked by this domain are mainly located in the Netherlands and a few have unconfigured web servers running.
Domain info:
Domain ID:D2608645-ASIA
Domain Name:DIRECTEDAT.ASIA
Domain Create Date:12-Apr-2013 03:21:04 UTC
Domain Expiration Date:12-Apr-2014 03:21:04 UTC
Domain Last Updated Date:03-May-2013 12:13:57 UTC
Last Transferred Date:
Created by:Internet.bs Corp. R176-ASIA (814)
Last Updated by Registrar:Internet.bs Corp. R176-ASIA (814)
Sponsoring Registrar:Internet.bs Corp. R176-ASIA (814)
The times that I did observe this domain and blogged about it was most likely manually. What I noticed to be odd was the low amplification my scripts calculate and I wonder why..
When looking at recent activity (http://dnsamplificationattacks.blogspot.nl/2013/05/nl-19216213762-as16265.html):
---------------------------------------------------------------------
Requested DNS record: directedat.asia
Query count: 9
Start: 2013-05-08 20:11:16
End: 2013-05-08 20:59:23
Duration: 48 minute(s)
Average query rate: 0.19 per minute
Detected a query rate below 1 per minute. Either a low query attack or there was a long break between bursts See chart for more details.
All request were made with the DNS id: 0xca0c
Average query size: 86 bytes
Average response size: 86 bytes
Amplification: 0%
--------------------------------------------------------------------------------
You can see a amplification of 0%. Not really effective now is it? So what does this domain name return when requested? Well as it runs out. A lot more than a 0% amplification. Check this dig query output on Pastebin:
http://pastebin.com/2vdmzTGM
Wow that response contains about 260 values! Then why does my script only calculates a 0% amplification?
My server does not support TCP this port is not permitted and it is required as you can see:
dig any directedat.asia +edns=0
;; Truncated, retrying in TCP mode.
That is perhaps why my server teruns "Server failure" all the time. But in the pcaps I do see it receives 'some' values.
What I see:
--------------------------------------------------------------------------------
1) I receive a spoofed DNS query for any directedat.asia from 192.162.137.62. (attacked ip)
src dst proto len desciption
192.162.137.62 192.168.10.37 DNS 86 Standard query ANY directedat.asia
2) I perform a DNS query to
g.root-servers.net. for directedat.asia.
192.168.10.37
192.112.36.4
DNS
70
Standard query NS <Root>
3) Receive a response from the root server giving me the name servers for .asia:
192.112.36.4
192.168.10.37
DNS
753
Standard query response
Response records:
a0.asia.afilias-nst.info: type A, class IN, addr 199.19.55.1
a2.asia.afilias-nst.info: type A, class IN, addr 199.249.114.1
b0.asia.afilias-nst.asia: type A, class IN, addr 199.254.28.1
b2.asia.afilias-nst.org: type A, class IN, addr 199.249.122.1
c0.asia.afilias-nst.info: type A, class IN, addr 199.254.29.1
d0.asia.afilias-nst.asia: type A, class IN, addr 199.254.30.1
a0.asia.afilias-nst.info: type AAAA, class IN, addr 2001:500:d::1
a2.asia.afilias-nst.info: type AAAA, class IN, addr 2001:500:42::1
b0.asia.afilias-nst.asia: type AAAA, class IN, addr 2001:500:16::1
b2.asia.afilias-nst.org: type AAAA, class IN, addr 2001:500:4a::1
c0.asia.afilias-nst.info: type AAAA, class IN, addr 2001:500:17::1
d0.asia.afilias-nst.asia: type AAAA, class IN, addr 2001:500:18::1
4) I query
d0.asia.afilias-nst.asia for any directedat.asia
192.168.10.37
199.254.30.1
DNS
86
Standard query ANY directedat.asia
5) Responds with authoritive name servers
199.254.30.1
192.168.10.37
DNS
624
Standard query response
9
Response Records:
directedat.asia: type NS, class IN, ns ns1.nitroushost.com
directedat.asia: type NS, class IN, ns ns2.nitroushost.com
6) I query
f.root-servers.net for A/AAA ns2.nitroushost.com
192.168.10.37
192.5.5.241
DNS
90
Standard query A ns2.nitroushost.com
192.168.10.37
192.5.5.241
DNS
90
Standard query AAAA ns2.nitroushost.com
192.168.10.37
192.5.5.241
DNS
90
Standard query A ns1.nitroushost.com
192.168.10.37
192.5.5.241
DNS
90
Standard query AAAA ns1.nitroushost.com
7) Received response:
4 times the same.
192.5.5.241
192.168.10.37
DNS
785
Standard query response
a.gtld-servers.net: type A, class IN, addr 192.5.6.30
b.gtld-servers.net: type A, class IN, addr 192.33.14.30
c.gtld-servers.net: type A, class IN, addr 192.26.92.30
d.gtld-servers.net: type A, class IN, addr 192.31.80.30
e.gtld-servers.net: type A, class IN, addr 192.12.94.30
f.gtld-servers.net: type A, class IN, addr 192.35.51.30
g.gtld-servers.net: type A, class IN, addr 192.42.93.30
h.gtld-servers.net: type A, class IN, addr 192.54.112.30
i.gtld-servers.net: type A, class IN, addr 192.43.172.30
j.gtld-servers.net: type A, class IN, addr 192.48.79.30
k.gtld-servers.net: type A, class IN, addr 192.52.178.30
l.gtld-servers.net: type A, class IN, addr 192.41.162.30
m.gtld-servers.net: type A, class IN, addr 192.55.83.30
a.gtld-servers.net: type AAAA, class IN, addr 2001:503:a83e::2:30
b.gtld-servers.net: type AAAA, class IN, addr 2001:503:231d::2:30
8) I query
h.gtld-servers.net for ns2 and ns1 .nitroushost.com in A/AAAA:
192.168.10.37
192.54.112.30
DNS
90
Standard query A ns2.nitroushost.com
192.168.10.37
192.54.112.30
DNS
90
Standard query AAAA ns1.nitroushost.com
192.168.10.37
192.54.112.30
DNS
90
Standard query AAAA ns2.nitroushost.com
192.168.10.37
192.54.112.30
DNS
90
Standard query A ns1.nitroushost.com
9) Receive response from
h.gtld-servers.net:
192.54.112.30
192.168.10.37
DNS
713
Standard query response
Received Records:
eva.ns.cloudflare.com: type A, class IN, addr 173.245.58.114
eva.ns.cloudflare.com: type AAAA, class IN, addr 2400:cb00:2049:1::adf5:3a72
tim.ns.cloudflare.com: type A, class IN, addr 173.245.59.145
tim.ns.cloudflare.com: type AAAA, class IN, addr 2400:cb00:2049:1::adf5:3b91
10) I query tim.ns.cloudflare.com for ns1 ns2 .nitroushost.com in A / AAAA
192.168.10.37
173.245.59.145
DNS
90
Standard query A ns2.nitroushost.com
192.168.10.37
173.245.59.145
DNS
90
Standard query AAAA ns1.nitroushost.com
192.168.10.37
173.245.59.145
DNS
90
Standard query AAAA ns2.nitroushost.com
192.168.10.37
173.245.59.145
DNS
90
Standard query A ns1.nitroushost.com
11) Responses (combined):
173.245.59.145
192.168.10.37
DNS
95
Standard query response A 192.95.50.70
173.245.59.145
192.168.10.37
DNS
95
Standard query response A 192.95.50.69
12) query
ns2.nitroushost.com for directedat.asia in any:
192.168.10.37
192.95.50.70
DNS
86
Standard query ANY directedat.asia
--- No response ---
13) query
ns1.nitroushost.com for directed.asia in any:
192.168.10.37
192.95.50.69
DNS
86
Standard query ANY directedat.asia
--- No response ---
- A few more attempts at both name servers but no luck.
My server responds with:
14 ) Server failure sent to spoofed IP:
src dst proto len desciption
192.168.10.37 192.162.137.62 DNS 86 Standard query response, Server failure
-------------------------------------------------------------------
This was an interesting example of DNS recursion.
After a few requests from the spoofed IP I observe a response from the name server:
Request and response
ns1.nitroushost.com:
192.168.10.37
192.95.50.69
DNS
75
Standard query ANY directedat.asia
192.95.50.69
192.168.10.37
DNS
554
Standard query response SOA ns1.nitroushost.com NS ns1.nitroushost.com NS ns2.nitroushost.com A 204.11.52.232 A 204.11.52.233 A 204.11.52.234 A 204.11.52.235 A 204.11.52.236 A 204.11.52.237 A 204.11.52.238 A 204.11.52.239 A 204.11.52.240 A 204.11.52.241 A 204.11.52.242 A 204.11.52.243 A 204.11.52.244 A 204.11.52.245 A 204.11.52.246 A 204.11.52.247 A 204.11.52.248 A 204.11.52.249 A 204.11.52.250 A 204.11.52.251 A 204.11.52.252 A 204.11.52.253 A 204.11.52.254 A 204.11.52.255
The response is too big for one packet and my servers attempts but fails to fall over to TCP.
This results my server to respond for this domain with 'server failure'.
I think TCP 53 is blocked for all incoming packets including '--related'.
I will look in to this to see if I can participate in these attacks to see its amplification. Especially if the spoofed client IP will participate in a TCP handshake or not.
UPDATE:
Today I saw another 'attack' with this see
HERE and noticed an amplification of 133%. Interesting.
----------------------------------
Requested DNS record: directedat.asia
Query count: 19
Start: 2013-05-14 09:46:41
End: 2013-05-14 19:36:31
Duration: 9:49:00
Average query rate: 0.0322580645161
All request were made with the DNS id: 0x8f1c / 36636
Average query size: 86 bytes
Average response size: 200 bytes
Amplification: 133%
----------------------------------
Looking at one of the query's in my pcaps, I see that my server retuns only the SOA and NS records for the domain, the old name server records for that matter.
New name server details:
#dig any directedat.asia @8.8.8.8
; <<>> DiG 9.8.4-rpz2+rl005.12-P1 <<>> any directedat.asia @8.8.8.8
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44011
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;directedat.asia. IN ANY
;; ANSWER SECTION:
directedat.asia. 4510 IN SOA ns1.voidhost.net. support.voidhost.net. 2013051406 86400 7200 3600000 86400
directedat.asia. 4510 IN NS ns1.voidhost.net.
directedat.asia. 4510 IN NS ns2.voidhost.net.
;; Query time: 14 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue May 14 21:00:45 2013
;; MSG SIZE rcvd: 125
No more 200+ response?
End of update
-------------------------------------------------------------------
Attacks and its origin
-------------------------------------------------------------------
It seems it is the same host that is performing these 'attacks'.. I concluded this by looking at the TTL values of all the IPs that requested directedat.asia.
----------------------------------------------------------------------
01-May-2013_134.19.181.30
79x 247
01-May-2013_50.7.190.60
28x 247
04-May-2013_134.19.181.30
3x 245
179 247
1x 55
1x 57
05-May-2013_134.19.181.30
8x 245
81x 247
08-May-2013_192.162.137.62
10x 245
09-May-2013_178.18.17.16
2x 245
09-May-2013_192.162.137.62
4x 245
10-May-2013_178.18.17.16
5x 245
11-May-2013_188.95.48.25
4x 245
25-Apr-2013_134.19.181.30
4x 247
1x 55
1x 57
25-Apr-2013_89.248.160.192
15x 247
1x 56
26-Apr-2013_134.19.181.28
2x 245
27x 247
27-Apr-2013_134.19.181.28
1x 247
----------------------------------------------------------------------
I normally use the TTL value to determine if it is one host performing this attack. As a single stable TTL cannot realistically be spoofed.
The TTL of 247 seems the most common and is probably the main source of the attacks. What the other hosts are.. perhaps a bot or two? Who knows!
UPDATE:
Seeing some activity for nukes.directedat.asia 511 A records in the response. All records are in the 172.33.44 and 172.33.43 range. The response exceeds the 1400 size limit for UDP and tries to fallback to TCP. But the attacked client obviously doesn't do this.
UPDATE:
MyDnsScan.Us is related to DirectedAt.Asia see this post:
http://dnsamplificationattacks.blogspot.nl/2013/06/domain-mydnsscanus.html
Update 25/06/2013
Dongs.directedat.asia same name servers also 511 return records.
Update 11/07/2013
d.directedat.asia is being used. 256 A records in 172.33.43.x range. ~4115 response size.
UPdate 14/070/2013
f.directedat.asia is using 119 A records in the 172.33.43 range. ~1939 response size.
