Gushing Resolvers: Measuring Open Resolvers’ Recursive Behavior

Open resolvers can be easily exploited by malicious actors to launch DDoS attacks against important services on the Internet, which has aroused much concern in the Internet community. Researchers have studied extensively the population, structure, and malicious behavior of open resolvers, while little has been done to reveal how open resolvers respond to non-recursion queries. In this paper, we conduct an Internet-wide measurement on the recursive behavior of open resolvers. We discover that more than 1 million gushing resolvers in the wild are more enthusiastic than needed to respond to non-recursive queries, either triggering a new recursive resolution process or replying with cached records. Furthermore, we discuss possible security implications posed by the massive gushing resolvers. Specifically, we show that gushing resolvers are prone to be targets of ranking manipulation attacks if they happen to be the data collection points of top lists. At last, we put forward suggestions for resolver operators to improve such a situation.