Chrome's weird DNS lookups

SANS ISC Handler Bojan Zdrnja has a great post on the ISC diary about how Google Chrome performs DNS prefetching lookups in order to speed up browsing.  I hope you find the post as interesting as I did.

https://isc.sans.edu/diary/Google+Chrome+and+(weird)+DNS+requests/10312

Adding to Bojan's post I found a tip on how to disable the function:
http://hanxue-it.blogspot.com/2014/04/how-to-disable-dns-prefetching-in.html

Anti-DDoS protection added to BIND DNS

A new version of BIND DNS has added a mechanism which will help combat against reflected Denial-of-Service (DoS) attacks, or specifically against a DNS amplification attack.  This module was introduced into version 9.9.4.

What is a DNS amplification attack?  It's an attack where, using the UDP transport, the attacker uses a large group of open resolvers to execute a DNS lookups with the source address spoofed to look like it's coming from the victim/target.  Usually the lookup is for all records ("ANY" in DNS speak) of a particular domain (or zone) so that large amounts of response traffic is sent to the victim/target which consume large amounts of bandwidth and/or CPU of the target.  This will keep the target busy and potentially make it unavailable.  More details about how the attack works can be found here:
US-CERT
Anatomy of a DNS DDoS Amplification Attack

Deep Inside a DNS Amplification DDoS Attack

So how can RRL help mitigate these attacks?  In essence, RRL examines the pattern of DNS requests and throttles the response to the requests when it detects an attack.  According to the documentation, it's highly configurable to combat against many types of attacks.  An important note is that incoming requests cannot be throttled by RRL.

While the attacks are not new, there has been an increase of them recently.  I recommend considering deploying this feature.

More information about BIND and RRL:

BIND 9.9.4 release notice

ISC
Using RRL to Prevent DNS Amplification Attacks
Quick introduction to Response Rate Limiting
How to enable Response Rate Limiting (RRL) on BIND 9.9.4
Download BIND from here

ICANN grilled by Congressional subcommittee

Event:

Oversight of the Internet Corporation for Assigned Names and Numbers (ICANN)
Hearings - Subcommittee on Communications, Technology, and the Internet
June 04, 2009
The Subcommittee on Communications, Technology, and the Internet held a hearing titled, "Oversight of the Internet Corporation for Assigned Names and Numbers (ICANN)" on Thursday, June 4, 2009, in 2123 Rayburn House Office Building. The hearing examined issues related to ICANN, including the expiring Joint Project Agreement between the Department of Commerce and ICANN, as well as ICANN's proposed introduction of new generic Top Level Domains (gTLDs).

I found this event very interesting. It is a hearing to discuss the renewal of the Joint Project Agreement (JPA) between the US Dept of Commerce and ICANN. Among other things the JPA provides the US Govt (through NTIA) oversight of ICANN's operations. This agreement expires in September this year.

There were several people testifying during this event including the President of ICANN, GoDaddy's General Council, representative from Verizon, representative from NTIA, and a couple others who I missed their names.

There were several concerns put on the table: accountability, transparency, efficacy, stability and security. Many had sharp criticism of ICANN's progress toward a safe and stable Internet domain name governance system. They along with the Congressional subcommittee were not satisified with ICANNs response to shutdown malicious domains and questioned why they aren't taking more action against domain Registrars who violate their policies and agreements with ICANN. ICANNs President did not seem to have good answers which led the hearing chair to ask for written proof of the actions they have taken. I suspect this will lead to more probing by the subcommitte because it's my opinion, as well, that ICANN is not doing their job here! As I continue to see bad Registrars allowing new malicious domain names to operate.

Concerns over the additional gTLD (global Top Level Domain) proposal were expressed. If you aren't aware, ICANN is proposing to allow new long gTLDs be created and sold. For example .MOVIE, .LEGAL, etc. The main concern had to do with trademark protection.

All panelists who testified, with the exception of the ICANN President, wants to see Congress renew the JPA. The overridding concern if it isn't was the lack of transparancy and security of the system. Several stated a concern that a nation who is not friendly with the US might take over of ICANN and threaten the US' national security. I share this concern.

If you are involved in fighting malicious websites or spam or curious about ICANN's operations I recommend watching the videos of the hearings. You'll find downloadable files here:

http://energycommerce.house.gov/index.php?option=com_content&view=article&id=1642&catid=134&Itemid=74

Let's hope this helps drive ICANN to take the necessary measures to dramatically improve their measures when fighting malicious domains. In other words, do what they should be doing anyway!!!