Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have encountered an issue that has been puzzling me for several time. Hopefully someone will help me understand what is happening or point in right direction.

One of my servers (CentOS 6.x) started sending massive DNS requests to our DNS provider, causing DoS alerts.

As stated from the DNS provider, 239000 queries/5min were sent.

Log sample (CentOS is 2xx.2xx.2xx.2xx , DNS is 1xx.1xx.1xx.1xx):

29-Oct-2013 21:24:08.444 queries: client 2xx.2xx.2xx.2xx#38597: view internal: query: boot.servequake.com IN A + (1xx.1xx.1xx.1xx)

29-Oct-2013 21:24:08.445 queries: client 2xx.2xx.2xx.2xx#60776: view internal: query: boot.servequake.com IN A + (1xx.1xx.1xx.1xx)

29-Oct-2013 21:24:08.446 queries: client 2xx.2xx.2xx.2xx#46437: view internal: query: boot.servequake.com IN A + (1xx.1xx.1xx.1xx)

Actions taken on my Server: Logged and blocked all requests to the DNS servers using IPtables, added "0.0.0.0 boot.servequake.com" to hosts and presently it generates 1375 entries/5min. Couldn't find any evidence of exploit in the server.

This CentOS server is running multiple apps and has a public IP. At first, the reason could be an app malfunction or some intentional DoS attack using my server as "zombie". I simply searched for "boot.servequake.com" (to understand why this adress resolution is being requested) and i got very few and useless results in our favourite search engine. Also tested ping and traceroute for boot.servequake.com and it resolves to 0.0.0.0 with no hops. This happens in all CentOS servers, CentOS VM's, Ubuntu workstations, but not in the affected server.

Questions:

  1. Is "boot.servequake.com" some sort of an alias of 0.0.0.0 included in this Linux distros?
  2. If so, why can't I find any info about it online?
  3. Where could I find this configuration?(its not in hosts file)
  4. Why is a .servequake.com (property of no-ip.com) being used in all the tested Linux machines?

Thanks in Advance

EDIT: corrected "localhost" to "0.0.0.0"

share|improve this question
    
You write: >Where could I find this configuration?(its not in hosts file) and some lines above: >added "127.0.0.1 boot.servequake.com" to hosts -> If you have added this to your hosts file, it's no wonder the hostname resolves to localhost now. Without a hosts entry, it should resolve to 0.0.0.0 (says my box). –  etagenklo Nov 20 '13 at 10:43
    
Maybe I wasn't clear, the host file had no entry, just like yours. But instead of resolving 0.0.0.0 like all other Machines, it spammed the DNS server. I realized adding this entry would at least prevent trying to resolve to any other IP. Also you are right, I meant 0.0.0.0 instead of localhost. And thanks to you, now I got confirmation boot.servequake.com resolves there and not a random "Quake Server". However, how can I put it back to 0.0.0.0? –  Raul Cardoso Nov 20 '13 at 11:00
    
What exactly do you mean by "How can I put it back to 0.0.0.0"? What does it resolve to on your machine? –  etagenklo Nov 20 '13 at 11:05
    
All my machines resolve to 0.0.0.0 but not the Affected CentOS server. It tries to query DNS and causes DoS unless I add an entry in hosts file. thanks again –  Raul Cardoso Nov 20 '13 at 11:08
    
All your machines have to query DNS first until they resolve this domain to 0.0.0.0. How else should they know this? –  etagenklo Nov 20 '13 at 12:21

1 Answer 1

up vote 2 down vote accepted

Oh my. Really having a bad day? ;)

1: OBVIOUSLY not. Seriously. Do they sound identical?

2: I can. www.servequake.com redirects to http://freedns.no-ip.com/ - a free dns service for people behind dynamic IP's. I would say one of their customers has the name "boot" registered. And likely this is not something they bother to use publicly (maybe just some quake server between friends) so you wont have it mentioned all over the internet.

3: It is not your configuration so you can not find it at all. You dont just have access to no-ip internal configuration databases.

4: Because this is where the attack comes from or goes to.

I am not totally sure but it looks to me like you aer a relay for a DNS amplification attack - targeting either boot.servequake.com or your DNS provider (or you), but for knowing more you ahve to actually tell us what the netflows really are. Typically not the requests but the answers are hugh. The number of quests also indicates a caching issue somewhere, but that can be caused by no-ip (on pupose to fast update when the dynamic ip changes).

share|improve this answer
    
The subdomain was in fact configured with 0.0.0.0, turning into some alias of our own machine and that doesn't seem to represent the attack source or destination. Anyway, thanks to etangenklo too, this answer is now more clear. My Server was probably used as part of an attack and I need to dig in and secure it. thanks –  Raul Cardoso Nov 20 '13 at 14:09

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.