How to Harden Your DDoS Protection Infrastructure Against Compromise and DNS Amplification Attacks

Introduction

In a recent security incident, a Brazilian DDoS mitigation firm unknowingly hosted a botnet that launched massive attacks against local ISPs. Attackers gained root access to the company’s infrastructure via exposed SSH keys belonging to the CEO, then built a powerful botnet by scanning for insecure routers and unmanaged DNS servers. This guide walks you through the essential steps to protect your own DDoS protection services from being hijacked for such attacks. By following these measures, you can reduce the risk of your infrastructure being used as a launchpad for DNS reflection and amplification attacks.

How to Harden Your DDoS Protection Infrastructure Against Compromise and DNS Amplification Attacks — Source: krebsonsecurity.com

What You Need

Administrative access to routers, DNS servers, and network equipment
SSH key management tools (e.g., OpenSSH, key rotation scripts)
Network traffic monitoring software (e.g., ntop, Wireshark, or commercial solutions)
DNS server configuration access (e.g., BIND, Unbound, or appliance interfaces)
Firewall and intrusion detection systems (IDS/IPS)
Regular vulnerability scanning tools (e.g., nmap, Nessus)
Multi-factor authentication (MFA) solutions

Step-by-Step Guide

Step 1: Secure SSH Keys and Access Controls

Attackers gained root access using the CEO’s private SSH keys exposed in an open directory. Prevent this by:

Never storing private SSH keys in publicly accessible locations (e.g., open directories, cloud storage without proper permissions).
Regularly rotate SSH keys for all administrative users, especially those with root privileges.
Using strong passphrases for private keys and implementing key-based authentication with restricted commands (e.g., command="/usr/bin/rsync" in authorized_keys).
Enabling multi-factor authentication for SSH access (e.g., using Google Authenticator or hardware tokens).
Auditing SSH access logs daily for any unauthorized connection attempts.

Step 2: Audit and Monitor Network Infrastructure for Unauthorized Access

The exposed archive contained evidence of root access from a threat actor. To detect intrusions early:

Deploy network monitoring tools that alert on unusual outbound traffic or large volumes of DNS queries (potential scanning behavior).
Set up file integrity monitoring on critical system files (e.g., /etc/ssh, configuration files for DNS servers).
Conduct weekly vulnerability scans of all network-facing devices (routers, DNS servers, firewalls).
Look for signs of mass scanning from your own IP space—this indicates a compromised internal machine.

Step 3: Harden Routers Against Compromise

The botnet was built by scanning the internet for insecure routers. Protect your edge routers by:

Changing default administrative passwords and disabling default accounts.
Disabling unused services (e.g., telnet, SNMP, HTTP management interfaces) or restricting them to internal IPs only.
Enabling automatic firmware updates or establishing a manual patch cycle.
Implementing access control lists (ACLs) that limit inbound connections to only necessary ports.
Using strong encryption for management traffic (e.g., SSH version 2, HTTPS).

Step 4: Configure DNS Servers to Prevent Open Recursion and Amplification

DNS reflection attacks rely on misconfigured servers that respond to queries from anywhere. To prevent your DNS infrastructure from being used as an amplifier:

Set DNS servers to refuse recursive queries from any IP except your own internal networks. For authoritative-only servers, disable recursion entirely.
Limit response size by disabling EDNS0 or configuring maximum UDP packet sizes (e.g., set max-udp-size 512 in BIND).
Implement Response Rate Limiting (RRL) to throttle queries from a single source.
Use DNS firewall or blocklist for known malicious domains.
Regularly test your DNS servers using online tools (e.g., Open DNS Checker) to ensure they are not open resolvers.

Step 5: Mitigate DNS Amplification Impact

Even if your servers are secure, others may be used to attack you. To reduce damage from DNS amplification attacks:

Work with upstream ISPs to implement BCP 38 (ingress/egress filtering) to prevent spoofed source IP addresses.
Deploy DDoS mitigation services or appliances that can detect and drop large volumes of DNS response traffic.
Monitor for sudden spikes in incoming DNS traffic (UDP port 53).
Configure rate limiting on your network edge to block excessive DNS responses per source.

Step 6: Establish an Incident Response Plan

The attack was sustained for years before discovery. Be prepared with:

A clear plan for isolating compromised systems (e.g., disabling SSH keys, shutting down affected servers).
Regular backups of critical configurations (routers, DNS zone files) stored offline.
Communication protocol with law enforcement and abuse contacts (e.g., CERT.br for Brazil).
After an incident, conduct a full forensic analysis to identify root cause and ensure complete remediation.

Tips for Ongoing Protection

Never assume you are immune: Even DDoS mitigation firms can be targeted. Regularly test your own defenses.
Use integrity monitoring tools like Tripwire or OSSEC to detect changes to SSH keys and configuration files.
Segment your network: Isolate management interfaces from public-facing services to limit lateral movement.
Educate employees about phishing and social engineering that could lead to credential exposure.
Stay updated on new attack vectors (e.g., new DNS amplification techniques) by following security feeds.
Consider outsourcing attack surface monitoring to a reputable security firm if internal resources are limited.