On: Online Dispute Becomes Internet-Snarling Attack

[mdpye]

You don't change the resolver. ISPs need to drop UDP packets leaving their networks where the (spoofed) headers declare that they did not originate there. That way an attacker can't spoof the originator to have the responses directed at someone else.

Edit: clarity on actual vs declared origin

[jiggy2011 → mdpye]

That would cost some amount of money for an ISP to implement, and you need to get the major ISPs (most of them are not in the USA, many are in places like China) to all apply it.

[dasil003 → mdpye]

It also seems like a tractable problem in that upstream providers can test for the vulnerability and shut down uplinks for non-compliant customers.