The DNS reflection technique has been known for a long time. However, its recent use to launch DDoS attacks of unprecedented scale, like the one in March that targeted a spam-fighting organization called Spamhaus, has likely brought it renewed interest from attackers.
The attack experienced by DNSimple on Monday was significantly larger in volume and duration than other attacks that hit the company's name servers in the past, Eden said.
He believes that the attack is related to the ones experienced by easyDNS and TPP Wholesale. "The pattern displayed on TPP Wholesale's blog is similar to what we see, and we have been communicating with easyDNS and find similarities between the attacks."
EasyDNS and TPP Wholesale did not immediately respond to inquiries seeking more information about the recent attacks against their servers and confirmation that they were using DNS reflection techniques.
It's possible that DNS servers operated by other companies were also affected by this attack, Eden said. "A DNS provider will have a significantly higher number of customers and thus the attacks get noticed much sooner because it affects a larger group of people," he said.
DNSimple's authoritative name servers were used to amplify a DDoS attack directed at a server hosting company called Sharktech or one of its customers, Eden said.
Sharktech has noticed a surge of abuse reports in the past 24 hours coming from ISPs and hosting companies complaining about DDoS attacks against their DNS servers that appear to originate from Sharktech, said Tim Timrawi, president and CEO of Sharktech, via email. Upon further investigation the company determined that these reports were actually the result of a DNS amplification attack against its own customers that abused the authoritative DNS servers of those companies, he said.
Most of the affected DNS servers were secured properly and were being queried for domains they are responsible for, Timrawi said. "Unlike previous DNS Amplification Attacks in which the attacker used open recursive DNS servers, in this one, the attacker is collecting all the DNS servers they can find and sending MX (and other kind of queries) to them for their domain records with a spoofed source of the target host," he said.
The amplified DDoS attack targeting Sharktech customers was larger than 40Gbps, Timrawi said. "We are unaware of the reason behind the attacks," he said.
The abuse of authoritative name servers in DNS reflection attacks is not very common because attackers need to know the exact domain names that each abused server is responsible for, said Carlos Morales, vice president of sales engineering and operations at DDoS mitigation provider Arbor Networks. Obtaining this information is not very hard, but it does require additional work compared to abusing open DNS resolvers, and attackers usually prefer the easiest route to reach their goals, he said.
Sign up for CIO Asia eNewsletters.