tldr - powered by Generative AI
The presentation at the IEEE Symposium on Security and Privacy highlighted the DNSBomb attack technique, which uses IP-spoofing and DNS queries to overwhelm victims with amplified traffic. The attack aims to exploit DNS responses to achieve a high amplification factor.
- DNSBomb attack strategy involves IP-spoofing and withholding responses to overwhelm victims with amplified traffic.
- The attack was presented at the IEEE Symposium on Security and Privacy and GEEKCON 2023 events.
- ISC stated that BIND software suite is not vulnerable to DNSBomb.
- CatDDoS malware, which emerged in August 2023, targets victims primarily in China, the U.S., and other countries.
- CatDDoS uses ChaCha20 algorithm and OpenNIC domain for C2 communication to evade detection.
- CatDDoS shares the same key/nonce pair with other DDoS botnets like hailBot, VapeBot, and Woodman.
- New variants of CatDDoS emerged after the original authors shut down operations and leaked the source code.
Tags:
DNSBomb
CatDDoS
DDoS attack
IEEE Symposium