We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Lobsters·Jun 21·5 min read
Forward to Hell? On Misusing Transparent DNS Forwarders For Amplification Attacks
TL;DR
DNS infrastructure is vulnerable to amplification attacks, particularly through transparent DNS forwarders that do not modify packet headers. Research identified that these forwarders can expose shielded recursive resolvers, increasing the potential attack volume.
✦ Why It Matters
Engineers should prioritize securing transparent DNS forwarders to reduce the risk of amplification attacks.
Key Takeaways
- Implement access controls on DNS forwarders.
- Monitor DNS infrastructure regularly for vulnerabilities.
- Educate teams on the risks of transparent DNS forwarders.
- Consider deploying rate limiting on DNS queries.
Full Summary
DNS (Domain Name System) infrastructure has been a target for reflective amplification attacks, where attackers exploit DNS servers to amplify traffic towards a victim. Transparent DNS forwarders, which pass along DNS requests without altering packet headers, pose a significant risk as they can expose shielded recursive resolvers to attackers.
Over five years, researchers conducted weekly Internet-wide scans to monitor the state of open DNS infrastructure, revealing a decrease in open DNS devices from over 25 million in 2014 to 1.4 million in 2026. Despite responsible disclosures removing over 250,000 vulnerable devices, the number of transparent forwarders remained constant.
This stability suggests that they continue to serve as a viable vector for amplification attacks. The findings highlight the need for improved security measures targeting these specific components in the DNS ecosystem.