# MA-344.032013: MyCERT Alert - Recent DDOS Activities

**Date:** 28 Mar 2013  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-344.032013  
**Advisory ID:** MA-344.032013

---

**1.0 Introduction**
It has been reported for the past days that a massive Distributed Denial of Service (DDOS) attack with 300Gbps against a major non-profit Anti-spam organization, Spamhaus. The attack targeted Spamhaus website, spamhaus.org. The attacks have been ongoing since March 15 and considered to be the largest in the world. Spamhaus has quickly turned to CloudFlare, a company that secures websites and helps mitigate the effects of distributed denial-of-service attacks for mitigations against the attack.
**2.0 Impact**
The DDOS attack had affected and had caused difficulties to access Spamhaus website.
**3.0 Technical Analysis**
The attacks are in large part because the network operators continued to allow open DNS resolvers to run on their networks and the attackers have begun abusing them. The best practice, if running a recursive DNS resolver is to ensure that it only responds to queries from authorized clients. In other words, if running a recursive DNS server for your company and your company's IP space is of a particular range then it should only respond to queries from that range. If a query arrives from another range then it should not respond.
The problem is, many Administrators running DNS resolvers leave them open and willing to respond to any IP address that queries them. Recently a number of distinct botnets appear to have enumerated the Internet's IP space in order to discover open resolvers. Once discovered, they can be used to launch significant DNS Amplification Attacks. Is has been reported that there are many unique open resolvers participating in the attack from all around the world. The open resolvers need to be identified and take immediate action to rectify them accordingly.
**4.0 Recommendation**
System Administrators may search their  IP space at the below link for open DNS resolver.
- <http://openresolverproject.org/>
MyCERT advises all System Administrators to close open resolvers immediately. Leaving it open means you will continue to aid in the DDOS attack.
System Administrators may refer to the below documents on how to disable open resolver on their DNS servers:
- <http://www.team-cymru.org/Services/Resolvers/instructions.html>
**5.0 References**
- <http://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack>
- <http://www.team-cymru.org/Services/Resolvers/instructions.html>
- <http://blogs.computerworld.com/cybercrime-and-hacking/21967/biggest-ddos-attack-history-slows-internet-breaks-record-300-gbps>
If you need any assistance, do not hesitate to contact Cyber999 via the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#abc8d2c9ced9929292ebc8d2c9ced9d8cec8ded9c2dfd285c6d2) or [[email protected]](/cdn-cgi/l/email-protection#97faeef4f2e5e3d7faeef4f2e5e3b9f8e5f0b9faee)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)