france security
Use of public DNS servers for private DDOS stress test
<p>I read on this <a href="https://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack/" rel="nofollow noreferrer">Cloudflare's blog post</a> that hackers use misconfigured DNS servers to amplify their attacks.
The principle is to flood the DNS with queries, and "ask" the DNS to forward their answer to the victim to DDOS.</p>

<p>I planned a DDOS stress test at my company (with the agreement of my boss).
<br> I am pretty sure abusing DNS servers for my private audit is illegal, <br>
but I cannot find terms and conditions for these DNS providers,<br> so are there laws regulating the use of these services, to limit abuses.?</p>

<p>I am under the french jurisdiction, but if you have foreign example it may be interesting. </p>

<p>"Public" DNS servers are public in the sense that they are available for the public to use by the adminstrator of each server. But each DNS server is run by either a government entity (or semi-government, such as a university or a government run corporation) or a private telecom company. And as such, each entity that runs a DNS server will have TOS (terms of service) that dictates the use of that server.</p>

<p>And each - I'd assume - forbids DNS access in for form of high-volume, repeated accesses such as would be used in a DDOS stress test.</p>

<p>You should find the administrative domain and website of the DNS server you want to use - i.e., you mentioned Indonesia, so <code>kemdikbud.go.id</code> or <code>telkom.net.id</code>, etc., from <code>public-dns.info</code> - and read their TOS to determine their policies about access to their DNS services.</p>

<p>But there are many other factors involved in a DDOS stress test other than the one DNS service: you need to consider each ISP, each upstream provider, each network between the DNS service and the target server, in each country, as a DDOS attack - even a controlled stress test - creates huge amounts of traffic all across each network and as such costs time and money to each. And each services' TOS may very well forbid such use for a DDOS stress test.</p>

<p>So even though you have the approval of your boss for the test, I doubt very much he has approval from all of the necessary networks to use their services for a stress test.</p>

<p>In the US at least, DDOS attacks are illegal: <a href="https://www.law.cornell.edu/uscode/text/18/1030#a_5" rel="nofollow noreferrer">https://www.law.cornell.edu/uscode/text/18/1030#a_5</a></p>

<p>AFAIK, there is no global law regarding DNS server abuse; governance of the DNS system falls under ICANN <a href="https://en.wikipedia.org/wiki/ICANN" rel="nofollow noreferrer">https://en.wikipedia.org/wiki/ICANN</a></p>
