April 3, 2015 By Shane Schick 2 min read

Distributed denial-of-service (DDoS) attacks are bad enough already, shutting down sites or making them unusable. But officials are now warning that a multicast Domain Name System (DNS) vulnerability could make them far worse.

According to an advisory released on the CERT Knowledgebase, the multicast DNS vulnerability stems from a misconfiguration in some devices whereby the multicast DNS protocol responds to outside queries from the Internet rather than local queries from devices or services on the same network. That means cybercriminals could use the length of time for DNS responses using multicast DNS to amplify DDoS attacks. The multicast DNS vulnerability also means cybercriminals could potentially discover a lot of information about particular devices on a network, which could make it easier than ever to plot a cyberattack.

Chad Seaman, the researcher who discovered the multicast DNS vulnerability, wrote on GitHub that more than 100,000 devices could be affected and that DDoS traffic that exploits it could get a boost of nearly 1,000 percent. Even worse, this flaw could help better disguise DDoS attacks, making it harder for law enforcement agencies to track down perpetrators.

A story on ITworld pointed out that while other protocols — including the Simple Network Management Protocol and Network Time Protocol — have been used to boost the performance of DDoS attacks, the multicast DNS vulnerability needs further investigation to determine the software and devices that would respond to requests using it. However, a wide range of hardware products from well-known vendors were all among those potentially at risk.

According to Security Affairs, several vendors are already working on fixes, and there will undoubtedly be patches made available before too long. However, given the use of DDoS attacks on such high-profile targets as Sony Pictures Entertainment, this is the type of hole security professionals cannot afford to leave unfilled for long. In fact, a recent study on the subject showed DDoS attacks can cost $148,500 per hour, according to ZDNet.

On the plus side, stemming the possible damage could boil down to blocking a particular port, Port 5353, Threatpost said. This is where traffic could move between devices and services and where data could be leaked or attacks could originate. Enterprises may want to at least look into this as a first step as they assess their particular degree of exposure to the multicast DNS vulnerability.

Image Source: iStock

More from

Cyberattack on American Water: A warning to critical infrastructure

3 min read - American Water, the largest publicly traded United States water and wastewater utility, recently experienced a cybersecurity incident that forced the company to disconnect key systems, including its customer billing platform. As the company’s investigation continues, there are growing concerns about the vulnerabilities that persist in the water sector, which has increasingly become a target for cyberattacks. The breach is a stark reminder of the critical infrastructure risks that have long plagued the industry. While the water utility has confirmed that…

What’s behind unchecked CVE proliferation, and what to do about it

4 min read - The volume of Common Vulnerabilities and Exposures (CVEs) has reached staggering levels, placing immense pressure on organizations' cyber defenses. According to SecurityScorecard, there were 29,000 vulnerabilities recorded in 2023, and by mid-2024, nearly 27,500 had already been identified.Meanwhile, Coalition's 2024 Cyber Threat Index forecasts that the total number of CVEs for 2024 will hit 34,888—a 25% increase compared to the previous year. This upward trend presents a significant challenge for organizations trying to manage vulnerabilities and mitigate potential exploits.What’s behind…

Quishing: A growing threat hiding in plain sight

4 min read - Our mobile devices go everywhere we go, and we can use them for almost anything. For businesses, the accessibility of mobile devices has also made it easier to create more interactive ways to introduce new products and services while improving user experiences across different industries. Quick-response (QR) codes are a good example of this in action and help mobile devices quickly navigate to web pages or install new software by simply scanning an image.However, legitimate organizations aren’t the only ones…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today