Guidance for DNS amplification discussed in ADV200009

Abstract

On May 19, 2020, Microsoft released security advisory ADV200009. This advisory describes a DNS amplification attack that was identified by Israeli researchers. The attack, known as NXNSAttack, can target any DNS server, including Microsoft DNS and BIND servers that are authoritative for a DNS zone.

For DNS servers that reside on corporate intranets, Microsoft rates the risk of this exploit as low. However, DNS servers that reside on edge networks are vulnerable to NXNSAttack. Pre-Windows Server 2016 DNS servers that reside on edge networks should be upgraded to Windows Server 2016 or later versions that support the Response Rate Limit (RRL). RRL reduces the amplification effect when a targeted DNS resolver queries your DNS servers.

 

Symptoms

When a DNS amplification attack is made, you may observe one or more of the following symptoms on an affected server:

• CPU usage for DNS is elevated.

• DNS response times increase and responses may stop.

• An unexpected number of NXDOMAIN responses are generated by your authentication server.
  

Attack overview

DNS servers have always been vulnerable to an array of attacks. For this reason, DNS servers are generally placed behind load balancers and firewalls in a DMZ.

To exploit this vulnerability an attacker would have to have multiple DNS clients. Typically, this would include a botnet, access to dozens or hundreds of DNS resolvers that are capable of amplifying the attack, and a specialized attacker DNS server service.

The key to the attack is the specially built attacker DNS server that is authoritative for a domain that the attacker owns. For the attack to be successful, the DNS resolvers have to know how to reach the attacker’s domain and DNS server. This combination can generate lots of communication between the recursive resolvers and the victim's authoritative DNS server. The result is a DDoS attack.

Vulnerability for MS DNS on corporate intranets

Internal, private domains are not resolvable through Root Hints and top-level domain DNS servers. When you follow best practices, DNS servers that are authoritative for private, internal domains, such as Active Directory domains, are not reachable from the internet.

Although an NXNSAttack of an internal domain from the internal network is technically possible, it would require a malicious user on the internal network who has administrator-level access to configure internal DNS servers to point to DNS servers in the attacker domain. This user must also be able to create a malicious zone on the network and put a special DNS server that is capable of performing the NXNSAttack on the corporate network. A user who has this level of access will generally favor stealth over announcing their presence by initiating a highly visible DNS DDoS attack.
 

Vulnerability for edge-facing MS DNS

A DNS resolver on the internet uses Root Hints and Top-Level Domain (TLD) servers to resolve unknown DNS domains. An attacker can use this public DNS system to use any internet-facing DNS resolver to try NXNSAttack amplification. After an amplification vector is discovered, it can be used as part of a denial of service (DDoS) attack against any DNS server that hosts a public DNS domain (the victim domain).

An edge DNS server that acts as a resolver or forwarder can be used as an amplification vector for the attack if unsolicited incoming DNS queries that originate from the internet are allowed. Public access allows a malicious DNS client to use the resolver as part of the overall amplification attack.

Authoritative DNS servers for public domains must allow unsolicited incoming DNS traffic from resolvers that are doing recursive lookups from the Root Hints and TLD DNS infrastructure. Otherwise, access to the domain fails. This causes all public domain authoritative DNS servers to be possible victims of an NXNSAttack. Edge-facing Microsoft DNS servers should run Windows Server 2016 or a later version to gain RRL support.