TsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers
summary
A new DNS amplification method called TsuKing coordinates vulnerable resolvers via crafted referral chains and an attacker-controlled authoritative king to multiply retries into massive traffic. Real-world scan finds 1.3M resolver systems, >500 with >1,000 retries and one >100,000, >25% ignore the RD bit, >40% lack negative caching and >50% have 10+ egress servers. A seven-layer cascade turns one query into >3,000 queries; a referral loop sustains amplified traffic for 24+ hours from one packet per second. DNS retry, DNS chain, DNS loop
AI-written summary · about
chapters (9)
- 0:00Introduction to DNS hacking
- 2:00Tsunami attack overview
- 4:21Understanding DNS mechanics
- 7:21Complex resolver systems
- 11:51DNS retry vulnerabilities
- 15:40The DNS chaining attack
- 17:34Vulnerability conditions
- 20:00DNS loop attacks
- 21:21Defense and mitigation
related talks
25mDark Side of the DNS Force
26mMisuse of DNS, the Second Most Used Protocol
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
47mDNS On Fire
12mYour Shield is My Sword: A Persistent Denial-of-Service Attack via the...
34mPractical Steps for Reducing Exposure and Detecting Compromise
28mDarwin & Protocols
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection