What is Threat ID 40033 "DNS ANY Queries Brute Force DOS Attack"

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

What is Threat ID 40033 "DNS ANY Queries Brute Force DOS Attack"

L2 Linker

Hi All 

 

I need to know about Threat ID 40033 "DNS ANY Queries Brute Force DOS Attack". I found the firewall drop traffic and hit the threat id-40033, but we try to packet capture with this traffic for DNS query for same source and same destination is not reach 500 times per 60 seconds.  Why Palo drop the query packet? and what's traffic that hit list the threat id-40033?

 

 

Threat Prevention 

7 REPLIES 7

Cyber Elite
Cyber Elite

DNS ANY request means if client asks DNS server "give me all the data".

Now assume you host DNS server and receive DNS ANY request with forged source IP.

Incoming packet to you is small but outgoing packet you send out is big.

This can be used in DDoS attack if attacker sends DNS ANY requests with spoofed source IP of the victim.

DNS servers reply to victim and effectively attacker has achieved amplification attack.

 

You can test how DNS ANY request looks like from your computer command line:

nslookup -type=any www.ee

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L2 Linker

@Raido_Rattameister 

Thanks, I want to known, what traffic can be the cause of hit the Threat-ID?

Cyber Elite
Cyber Elite

DNS ANY request generates threat id 34842 (DNS ANY Request).

Multiple DNS ANY requests in a row generate 40033 (DNS ANY Queries Brute Force DOS Attack).

 

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

@Raido_Rattameister 

How can I check for this matter?
"Now assume you host DNS server and receive DNS ANY request with forged source IP."

"Incoming packet to you is small but outgoing packet you send out is big."

DNS ANY is logged under threat id 34842 so you can check firewall threat log using filter below..

( threatid eq 34842 )

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L5 Sessionator

According to the KB,
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmpCAC

 

40033 is triggered if a session has same source and same destination but triggers our child signature, 34842, 250 times in 30 seconds. (not 500 times per 60 seconds).

Cyber Elite
Cyber Elite

Every time computer tries to resolve DNS request it will send out request to every DNS suffix it has.

In addition depending on operating system it might send those requests to all its DNS servers simultaneously .

 

Add count column and you see that single line can actually be multiple events.

Below is small demo I ran through firewall.

Raido_Rattameister_0-1679982205266.png

 

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
  • 3693 Views
  • 7 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!