DNS reflection and amplification attacks remain a significant cybersecurity risk for organisations that rely on uninterrupted access to websites, applications and online services. These distributed denial-of-service (DDoS) attacks exploit weaknesses in how internet traffic is handled, allowing attackers to direct large volumes of unwanted data towards a target while using relatively limited resources.
The Domain Name System (DNS) is a fundamental part of internet infrastructure. It translates domain names into IP addresses, allowing users to access websites and online services without having to remember numerical addresses. DNS servers are therefore essential to the operation of many digital services, but misconfigured servers can be exploited as part of a DDoS attack.
A DNS reflection attack begins when an attacker sends requests to publicly accessible DNS servers using a falsified source IP address. Rather than directing the responses back to the attacker, the servers send them to the intended victim. This technique allows malicious traffic to be routed through third-party systems, making it more difficult to identify the original source of the attack.
Amplification increases the potential impact. Certain DNS requests can generate responses that are substantially larger than the original queries. By exploiting this difference, attackers can cause a relatively small amount of outbound traffic to generate a much greater volume of data directed at a target. The resulting traffic can overwhelm network connections and consume the resources required to maintain normal service.
The consequences can extend beyond temporary website disruption. Businesses may experience service outages, reduced customer access, lost revenue and additional costs associated with investigating and mitigating an incident. Prolonged disruption can also affect customer confidence and damage an organisation’s reputation.
In some cases, a DDoS attack may serve as a distraction while attackers attempt other malicious activities. Security teams dealing with an outage may face additional pressure to restore services quickly, potentially complicating the detection of separate attempts to access systems, steal information or deploy ransomware.
Corero Network Security plc (LON:CNS) is a global provider of automated business continuity and network security solutions.
