Yesterday, when doing a half-yearly clean up of my authoritative name servers, I found the measures of protecting ".hk" ccTLD systems from DDoS attacks as a result of malicious querying "popvote.hk" still in place. I purposely attached a screen dump for easy recall of my memory.
The solution was to tell clients that popvote.hk was hosted here and there was no need to go through “.hk”. HKCERT and HKISPA jointly appealed to all ISPs to do this in order to protect all kinds of service using .hk domains. Up to now, I am still not sure how many of them agreed to implement the interim measures.
On this related matter, attacks of popvote.hk brought some good development to the local ISP industry. Some ISPs have used resolvers and authoritative name servers in the same machines. During the attack period, larger volume of queries flooded their resolvers which made the authoritative name severs not workable. How could they explain to their customers the situation. If I were one of the customers, I would definitely ask popvote.hk was none of my business, why attacks on "popvote.hk" made all my name records vanished. In the light of increasing DNS attacks, ISPs in Hong Kong should have realised that they could not bundle a resolver and an authoritative name server in the same machine.
The solution was to tell clients that popvote.hk was hosted here and there was no need to go through “.hk”. HKCERT and HKISPA jointly appealed to all ISPs to do this in order to protect all kinds of service using .hk domains. Up to now, I am still not sure how many of them agreed to implement the interim measures.
On this related matter, attacks of popvote.hk brought some good development to the local ISP industry. Some ISPs have used resolvers and authoritative name servers in the same machines. During the attack period, larger volume of queries flooded their resolvers which made the authoritative name severs not workable. How could they explain to their customers the situation. If I were one of the customers, I would definitely ask popvote.hk was none of my business, why attacks on "popvote.hk" made all my name records vanished. In the light of increasing DNS attacks, ISPs in Hong Kong should have realised that they could not bundle a resolver and an authoritative name server in the same machine.
No comments:
Post a Comment