The DNS Water Torture Attack

[@richtourist]

Thank god for F5! What would we do without them!?

[@rygelxix]

Does the AFM have a cache that itself could be flooded to bring it down? Or does it just discard all of these fake requests no further question?

[@dronomads]

Awesome explanation John . Can we have a best practice recommendations to configure it on afm . Any guides with guidelines are appreciated

[@qsarkiss]

Beyond the name of this attack, i like the pen, the glass board & the way John Wagnon draw on it ( and from right to left...except if it is a mirror image with a mirror DevCentral logo on the Polo...is it ? :) ).

[@PascalMichkinE]

It is ! They made specific tshirts for these videos :)

[@amirhossein5055]

[@monitorinterfaces524]

very clear, one Q. F5 will take the hits for the DNS server, Won't this also utilize the box.

[@devcentral]

great question! This is why the AFM (Advanced Firewall Manager) can learn the subdomains of your web application and block the attack before it consumes all the resources when requesting illegitimate subdomains.

[@thetest6145]

Bind9 is not installed ubuntu apache is a web server, if cloudflare is using proxy ips, ip server ip addresses are hidden, in which case will the server be exposed to dns attacks? Need to know our attacker web server ip address attacking the DNS?

[@devcentral]

Hi there...if I understand the question correctly, you are asking if the attacker needs to know the IP address of your web server in order to attack using DNS Water Torture. This attack specifically targets the authoritative name server that would respond with the proper DNS information for your web server. So, the attack is not directly against the web server. Rather, it's against the name server that tells the Internet how to get to your web server. The idea is that, if the attacker can consume the resources of the authoritative name server for your website, then the name server can't respond to legitimate requests for your web server. Then, users won't be able to access your web server because they weren't given the proper DNS information (IP address) for how to access it. Hope this helps!

[@abhaypratap5311]

Can we deploy a filter in client side or middle to mitigate these kinds of attack...

[@devcentral]

Hi Abhay, great question! A filter for the client side wouldn't work for this because there's no way to reach out and configure every possible client that might attack you in this situation. Specifically for the Mirai botnet, many of the clients would be things like a DVR, wireless camera, etc. These are many of the "Internet of Things (IoT)" devices that have been taken over by the Mirai botnet. So, while these internet-connected devices can send DNS requests on behalf of the botnet, it would be basically impossible to reach out and try to put a filter on each of them. This is why it's important to implement a firewall (like the BIG-IP AFM) to filter out these malicious requests. I hope this helps!

[@serkantok5195]

great explanation btw. thanks..

[@devcentral]

glad you enjoyed it!

[@msa6467]

Good explanation

[@devcentral]

glad you enjoyed it!