2. Open DNS resolvers have to be closed ● Open resolvers respond to recursive queries from any host on the Internet ● Amplification DNS attack 2

3. Still Open DNS resolvers in NREN – Why? ● Reason offered – users are not aware of danger ●Remedy: have to work on their education, boost collaboration ●Following: reminder + instruction to fix problem on the most popular platform in Serbian NREN i.e. BIND 9.x and Microsoft DNS server on Windows 2003, 2008 ●The expected result did not occur !!! ●Lesson learned – some reasons may stay invisible from NREN’s point of view ● 78% of the persistently open resolvers in our NREN fit to template: ●DNS service on Microsoft platform Windows 2003, 2008 with primary zone file configured for at least one domain ●DNS service is integrated with few other services on the same server ●basic security protection implemented by packet filtering on router on uplink to NREN (caution if high bandwith availabe 1Gbps) ● Reason found out - lack of security DNS feature inherited in platform used at campuses ●Remedy: add another box –DNS server (with option to accept/deny recursive queries based on its ip source address, preferably BIND 9.x) or –firewall (stateful packet inspection) 3

4. Solution – add DNS server on site ● Option available Disable recursion block all requests 4

5. Solution – add DNS server at NREN 5

6. Solution – add firewall 6

7. Reasons of slow changes One vendor choice (Microsoft solution) has been already made Not easy to maintain just one “very different” box Hard to accept to outsource such an successfully provided and old service Preferable – the matter of very modest budget available in most institutions ● Option to wait on Microsoft to add appropriate feature in its platforms - It is not solution! 7

8. How to check? - Useful links ● Find the number of known open DNS resolver ●Per AS (for each AS over time period Jun 2006 - Jun 2013) –http://dns.measurement- factory.com/surveys/openresolvers/ASN-reports/20130516.html –http://dns.measurement- factory.com/surveys/openresolvers/ASN-reports/ ●Per address space (masks “longer” than /22) –http://openresolverproject.org/ –paste an address into the search box near the top ● Fast check for a single domain. ●www.intoDNS.com under Recursive Querieswww.intoDNS.com ● Also … 8

9. Thank you! E-mail: mara@rcub.bg.ac.rs

10. Solutions – additional server Without Animation 5