[Emerging-Sigs] Rule 2016016

waldo kitty wkitty42 at windstream.net
Thu Dec 20 09:25:55 HAST 2012


On 12/20/2012 13:51, Martin Holste wrote:
> Yes, see the Cloudflare link.  They are one of the victims we are seeing of the
> attack.  The attack works particularly if DNSSEC is enabled along with
> recursion.  In that case, the DNS server that is being abused to bounce
> amplified packets can take down an org's pipe entirely, along with the victim
> org.  The IP's you're seeing as sources are actually the intended victims, and
> the disreputable nature of some of them indicates a bit of a "gang war" going on
> as one criminal or syndicate targets another.

some might say we need more gang wars... without the collateral damage, of 
course... let them take themselves outta the game and the gene pool... saves 
having to nuke'em from orbit and letting some deities sort it all out ;) :P :lol:


More information about the Emerging-sigs mailing list