Executive Summary

This document is intended for the Internet technical community, particularly authoritative and recursive Domain Name System (DNS) operators, network operators, the Internet Corporation for Assigned Names and Numbers (ICANN), and policy makers. It explores several unresolved critical design and deployment issues that have enabled increasingly large and severe Distributed Denial of Service (DDoS) attacks using the DNS. While DDoS attacks can exploit multiple characteristics of network infrastructure and operations, the prevalence and criticality of the DNS means that securing it is both challenging and urgent. These unresolved DNS issues and related DDoS attacks pose a real and present danger to the security and stability of the Internet.

The first recommendation below is made to ICANN, while others are made to operators of Internet infrastructure and manufacturers. While in many instances they reflect actions not under ICANN’s control and actors not necessarily within ICANN’s usual community, they are meant to address the overall responsibilities of the multi-stakeholder community and encourage ICANN to take action where it is relevant to do so. In particular, this means ICANN should be looking for ways to increase the effectiveness of steps already being taken against DNS abuse and promoting the participation of others as well as pursuing the measures suggested here.

The Security and Stability Advisory Committee (SSAC) strongly recommends that all types of DNS operators and network operators take immediate steps to mitigate the design and deployment issues that make large scale DDoS attacks possible.

Specifically, the SSAC strongly recommends that:

1. ICANN should help facilitate an Internet-wide community effort to reduce the number of open resolvers and networks that allow network spoofing. This effort should involve measurement efforts and outreach.

2. All network operators should take immediate steps to prevent network address spoofing.

3. Recursive DNS server operators should take immediate steps to secure open recursive DNS servers.

4. Authoritative DNS server operators should support efforts to investigate authoritative response rate limiting.

5. DNS server operators should put in place operational processes to ensure that their DNS software is regularly updated and communicate with their software vendors to keep abreast of the latest developments.

6. Manufacturers and/or configurators of customer premise networking equipment, including home networking equipment, should take immediate steps to secure these devices and ensure that they are field upgradable when new software is available to fix security vulnerabilities, and aggressively replace the installed base of non-upgradeable devices with upgradeable devices. 

2. Why Is This Important?

Critically, basic controls for network access and DNS security have not been as widely implemented as is necessary to maintain and grow a resilient Internet. When increasingly higher-speed Internet connections are combined with the growing power of individual end user devices, an unintended result is an extraordinary and growing capacity for conducting extremely large scale and highly disruptive DDoS attacks using unsecured DNS infrastructure. Paradoxically, the networks that fail to implement the best current security practices are the sources, not the destinations, of attack data flows. Defenders are powerless to influence the design and implementation of the attackers’ preferred networks. It takes only a relatively modest number of end-user devices, for example, to build or rent as a botnet for an attacker to generate significant attack traffic using only a very few, generally well-managed DNS authoritative servers operated by entirely innocent third parties.

These attacks have been growing in size over time, and are disrupting individual businesses;3 entire networks, critical applications and services;4 and entire countries.5 The scale of attacks will continue to grow if the Internet community takes no further action.