<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">hi all,<div><br></div><div>here’s the second new SSAC report — SAC065 - DDoS Attacks Leveraging DNS</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span><a href="http://www.icann.org/en/groups/ssac/documents/sac-065-en.pdf">http://www.icann.org/en/groups/ssac/documents/sac-065-en.pdf</a><br><div><br class="webkit-block-placeholder"></div><div>please read the report in it’s original form and don’t rely on this extract — the detailed recommendations are great. i’d have included them, but my cut/paste skills resulted in a format-mess. so i’ve just included the one-line summary recommendations in the Executive Summary.</div><div><br></div><div>this report is another call to action — in this case, as an ISP, i feel that i’m included directly in this. i’m wondering how the ISP Constituency can join the effort that is being called for in this report, and would like to be put on the “interested in helping out list” if one is ever created.</div><div><br></div><div>again, the question. who does what? where do the resources come from? John Crain’s Security gang is hopelessly and woefully underfunded as it is. the ISP constituency raised the underfunding issue last year in our comments on the budget — and got roundly ignored, along with all the rest of the community input i saw. do we just shout again? shout louder? shout at somebody else? it’s ridiculous to think that his tiny gang can do much about this without more support from above.</div><div><br></div><div>meanwhile ICANN has multiple millions of dollars aimed at “Outreach” — shouldn’t a big slice of that be aimed at topics like this one, towards the network-operator and DNS-operator audiences described in this report?</div><div><br></div><div><rant ends></div><div><br></div><div>thoughts?</div><div><br></div><div>mikey</div><div><br></div><div><br></div><div>
<div class="page" title="Page 4">
<div class="section">
<div class="layoutArea">
<div class="column"><p><span style="font-size: 16pt; font-weight: 700;">Executive Summary
</span></p><p><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">This document is intended for the Internet technical community, particularly authoritative
and recursive Domain Name System (DNS) operators, network operators, the Internet
Corporation for Assigned Names and Numbers (ICANN), and policy makers. It explores
several </span><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPS'; font-style: italic">unresolved </span><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">critical design and deployment issues that have enabled increasingly
large and severe Distributed Denial of Service (DDoS) attacks using the DNS. While
DDoS attacks can exploit multiple characteristics of network infrastructure and
operations, the prevalence and criticality of the DNS means that securing it is both
challenging and urgent. These unresolved DNS issues and related DDoS attacks pose a
real and present danger to the security and stability of the Internet.
</span></p><p><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">The first recommendation below is made to ICANN, while others are made to operators
of Internet infrastructure and manufacturers. While in many instances they reflect actions
not under ICANN’s control and actors not necessarily within ICANN’s usual community,
they are meant to address the overall responsibilities of the multi-stakeholder community
and encourage ICANN to take action where it is relevant to do so. In particular, this
means ICANN should be looking for ways to increase the effectiveness of steps already
being taken against DNS abuse and promoting the participation of others as well as
pursuing the measures suggested here.
</span></p><p><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">The Security and Stability Advisory Committee (SSAC) strongly recommends that </span><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPS'; font-style: italic">all
</span><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">types of DNS operators and network operators take immediate steps to mitigate the
design and deployment issues that make large scale DDoS attacks possible.
</span></p><p><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">Specifically, the SSAC strongly recommends that:
</span></p>
<ol>
<li style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'"><p><span style="font-size: 12pt;">ICANN should help facilitate an Internet-wide community effort to reduce the
number of open resolvers and networks that allow network spoofing. This effort
should involve measurement efforts and outreach.
</span></p>
</li>
<li style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'"><p><span style="font-size: 12pt;">All network operators should take immediate steps to prevent network address
spoofing.
</span></p>
</li>
<li style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'"><p><span style="font-size: 12pt;">Recursive DNS server operators should take immediate steps to secure open
recursive DNS servers.
</span></p>
</li>
<li style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'"><p><span style="font-size: 12pt;">Authoritative DNS server operators should support efforts to investigate
authoritative response rate limiting.
</span></p>
</li>
<li style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'"><p><span style="font-size: 12pt;">DNS server operators should put in place operational processes to ensure that
their DNS software is regularly updated and communicate with their software
vendors to keep abreast of the latest developments.
</span></p>
</li>
<li style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'"><p><span style="font-size: 12pt;">Manufacturers and/or configurators of customer premise networking equipment,
including home networking equipment, should take immediate steps to secure
these devices and ensure that they are field upgradable when new software is
available to fix security vulnerabilities, and aggressively replace the installed base
of non-upgradeable devices with upgradeable devices. </span></p>
</li>
</ol>
</div>
</div>
</div>
</div></div><div>
<div class="page" title="Page 6">
<div class="section">
<div class="layoutArea">
<div class="column"><p><span style="font-size: 16pt; font-weight: 700;">2. Why Is This Important?
</span></p><p><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">Critically, basic controls for network access and DNS security have not been as widely
implemented as is necessary to maintain and grow a resilient Internet. When increasingly
higher-speed Internet connections are combined with the growing power of individual
end user devices, an unintended result is an extraordinary and growing capacity for
conducting extremely large scale and highly disruptive DDoS attacks using unsecured
DNS infrastructure. Paradoxically, the networks that fail to implement the best current
security practices are the sources, not the destinations, of attack data flows. Defenders are
powerless to influence the design and implementation of the attackers’ preferred
networks. It takes only a relatively modest number of end-user devices, for example, to
build or rent as a botnet for an attacker to generate significant attack traffic using only a
very few, generally well-managed DNS authoritative servers operated by entirely
innocent third parties.
</span></p><p><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">These attacks have been growing in size over time, and are disrupting individual
businesses;</span><span style="font-size: 6.000000pt; font-family: 'TimesNewRomanPSMT'; vertical-align: 5.000000pt">3 </span><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">entire networks, critical applications and services;</span><span style="font-size: 6.000000pt; font-family: 'TimesNewRomanPSMT'; vertical-align: 5.000000pt">4 </span><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">and entire countries.</span><span style="font-size: 6.000000pt; font-family: 'TimesNewRomanPSMT'; vertical-align: 5.000000pt">5
</span><span style="font-size: 12.000000pt; font-family: 'TimesNewRomanPSMT'">The scale of attacks will continue to grow if the Internet community takes no further
action. </span></p>
</div>
</div>
</div>
</div></div><div><br></div><div><br></div><div><br></div><div>
<br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; display: inline !important; float: none; ">PHONE: 651-647-6109, FAX: 866-280-2356, WEB: www.haven2.com, HANDLE: OConnorStP (ID for Twitter, Facebook, LinkedIn, etc.)</span>
</div>
<br></div></body></html>