News for hackers. Stuff that matters.

A comment on Every device with FB app is now DDoSing recursive DNS resolvers. Parent comment

Re:Every device with FB app is now DDoSing recursive DNS res... by jbotz on Monday October 04, 2021 @06:52PM (#28753334)
The problem isn't (wasn't) facebook.com's A records, it's that the authoritative nameservers for facebook.com are (were) unreachable. In theory someone could change the NS records for facebook on the .com nameservers to point somewhere else and serve up a fake facebook.com domain, but... 1) those NS records have a 6 hour TTL, so it would take a while be effective, and 2) who has the authority to do that?
[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by DaiPlusPlus on Monday October 04, 2021 @07:22PM (#28753649)
> those NS records have a 6 hour TTL

Why on earth would any system need a TTL beyond 1 hour? The longer the TTL the longer your outage period will be if a cache is poisoned.

[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by mcspiff on Monday October 04, 2021 @07:27PM (#28753705)
On the flip side, it’s the longer you can survive an outage by relying on enough clients having the cached records. So can go both ways a bit.
[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by toast0 on Monday October 04, 2021 @10:44PM (#28754945)
.com (used for Facebook authoritative DNS) and .net (used for WhatsApp) servers serve glue records with a 2 day TTL, and domain holders don't get to choose TTL. (the root servers serve glue records for the TLDs with a 2 day TTL as well).

So, two days is the TTL you get for your NS records. Of course, it takes way more than two days for people to stop querying your old records. I gave up after 30-45 days.

[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by jbotz on Monday October 04, 2021 @10:07PM (#28754764)
Heh. I remember the day when a TTL of a week was pretty standard.

Anyway, the since the NS records for a domain come from the next level up, i.e. in this case the .com nameserver which are also the root nameservers, if they had a short TTL then those root nameservers would get hit pretty hard. Also, it isn't your choice what the TTL on your NS records is, it's admins of your top-level domains.

[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by throwaway09223 on Tuesday October 05, 2021 @12:30AM (#28755516)
"Why on earth would any system need a TTL beyond 1 hour?"

Load. Lower TTLs mean shorter term caches and more traffic.

This is a big deal, especially for root servers -- which is why the TTL is not customizable.

[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by fomine3 on Tuesday October 05, 2021 @04:05AM (#28756633)
Shorter TTL increases poisoning risk. Anyway attacker can set arbitrary TTL if they succeed poisoning so longer TTL won't increase risk.
[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by Thorrez on Monday October 04, 2021 @10:06PM (#28754763)
Could something with a normal 1 hour TTL be poisoned by a cache entry with a 30 day TTL?
[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by dotancohen on Tuesday October 05, 2021 @01:57AM (#28755921) 

  > The problem isn't (wasn't) facebook.com's A records, it's that the
  > authoritative nameservers for facebook.com are (were) unreachable.
The problem isn't (wasn't) DNS, it's that a large number of websites rely on a single point of failure in order to function properly.
[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by junon on Monday October 04, 2021 @07:15PM (#28753597)
I would assume DNS providers were on call with FB staff to manually trigger flushes across the system to prop the records ASAP. Of course this doesn't affect client TTLs but resolution failures generally aren't cached anyway.
[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by yourad_io on Monday October 04, 2021 @07:25PM (#28753673)
Speaking of flushing, today I learned that Google public DNS has an open "flush" function:

https://dns.google.com/cache

[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by celsoazevedo on Monday October 04, 2021 @08:00PM (#28753946)
Cloudflare: https://1.1.1.1/purge-cache/

OpenDNS: https://cachecheck.opendns.com/

[ Parent | on HN ]
Re:Every device with FB app is now DDoSing recursive DNS res... by hamilyon2 on Monday October 04, 2021 @10:59PM (#28755037)
Dns providers are basically every ISP in existence, it would be impractical to communicate with by phone calls
[ Parent | on HN ]