In these, the attacker sends crafted requests to an unwitting third party, and that third party then floods the victim with traffic. DNS amplification is probably the best known, here, since DNS is (usually) over UDP which has no persistent connection for replies:
- Send a DNS query to a DNS server, using your victim's IP address as the "source IP" for the query. Make the query something with a huge response, like using "ANY".
- DNS server responds to the victim's IP address, sending many big UDP packets with the response. After all, it can't know any better - it must* just trust the claimed source IP!
- Victim gets a huge flood of UDP traffic, overwhelming IP-level infrastructure like routers and switches.
This lets a relatively small attacker multiply ("amplify") their impact - and they do it while traversing a third party, making them more hidden.
---
* If course, there actually are mitigations for this; it's possible to detect this spoofing. But this is how DNS operators have worked in the past.
That's a pretty closed minded way of looking at things.
I don't trust them + i don't speak the language. So entirely blocking it is an easy decision.
Nextdns on my router blocks generated domains, which could be used against c&c servers.
Thanks for reminding me
OTOH most pirate library sites are hosted in those countries for the same reason.
With spam calls, ransomware, and most other forms of cybercrime, the problem is that Russia/China and many 3rd world countries don't extradite/cooperate or have the resources to work with international authorities.
I sometimes wonder how much safer the internet would be if China and Russia were cut off. Wouldn't be so great for the already poor state of liberty in either country, but the rest of the world would certainly benefit.