Weekly edition	Kernel	Security	Distributions	Contact Us	Search
Archives	Calendar	Subscribe	Write for LWN	LWN.net FAQ	Sponsors

Spam Sites Crippled by Lycos Screensaver DDoS (Netcraft)

Posted Dec 2, 2004 22:57 UTC (Thu) by pflugstad (subscriber, #224)
In reply to: Spam Sites Crippled by Lycos Screensaver DDoS (Netcraft) by dskoll
Parent article: Spam Sites Crippled by Lycos Screensaver DDoS (Netcraft)

I think they're doing this already. I recall reading on NANOG about spammers advertising sites that are "unkillable" or some such. Some NANOGers looked into it and essentially the spammers are using the zombies either as web servers or web proxies - DNS name for target gets updated on a minute by minute basis or some such (long list of alternate IPs for web site, each is a zombie). It was fairly sophisticated and would be quite difficult to stop.

(Log in to post comments)

Posted Dec 3, 2004 21:48 UTC (Fri) by rmini (subscriber, #4991) [Link]

DNS DDOS, then.

Spam Sites Crippled by Lycos Screensaver DDoS (Netcraft)

Posted Dec 9, 2004 13:19 UTC (Thu) by copsewood (subscriber, #199) [Link]

No. Not the way to do it. DNS enquiries are cached all over the world. To
defeat a DDOS on a DNS server for a domain, all the spammer has to do is increase the TTL until the content server can handle the load.

Spam Sites Crippled by Lycos Screensaver DDoS (Netcraft)

Posted Dec 9, 2004 13:26 UTC (Thu) by copsewood (subscriber, #199) [Link]

>It was fairly sophisticated and would be quite difficult to stop.

To stop it you would have to get the ISP handling the IP for the spammers DNS server to pull that DNS server off the network, or get the ISPs upstream provider to block that IP address if the ISP takes too long to respond. If the spammer running this DNS server sent out responses to all enquiries prior to the DNS server being shut down with a long TTL, this would determine a window of opportunity for this crack to continue working. Does DNS have a maximum value for TTL on A records ? The problem is then the cached copies of these records and how long it takes for these to be dropped by the DNS caches.