5. WHAT IS DNS?
Its like Yellow Pages of the Internet.
A globally distributed, loosely coherent, scalable, reliable, dynamic
database
Comprised of three components
1. A “name space”
2. Servers making that name space available
3. Resolvers (clients) which query the servers about the name
space
DNS ATTACKS 5
12. DNS VULNERABILITIES
DNS was designed with usability in mind and not Security.
Security:
Confidentiality: NOT A CONCERN
Data Integrity: BIG CONCERN
UDP Based design: Any correctly formatted DNS response over UDP
can be considered legitimate.
DNS attack tools are readily available on the Internet (for example,
dsniff, dnshijack, and many more) and they are all FREE!
DNS ATTACKS 12
13. DNS VULNERABILITIES
Cache impersonation
Corrupting data Impersonating master
Zone
administrator
Master Recursor
Zone file
Dynamic
updates Slaves
Resolver
Cache pollution by
Unauthorized updates Data spoofing
DNS ATTACKS 13
15. DNS ATTACKS?
DNS KNOWN THREATS: (Source RFC 3833)
1. Packet Interception
2. ID Guessing and Query Prediction
3. Name Chaining
4. Betrayal By Trusted Server
5. Denial of Service
6. Authenticated Denial of Domain Names
DNS ATTACKS 15
16. DNS ATTACKS?
1. DNS Amplification Attack
2. DNS Cache Poisoning / DNS Spoofing
3. (DDoS) Distributed Denial of Service attack
4. BIND9 Spoofing
DNS ATTACKS 16
17. DNS AMPLIFICATION ATTACK
Attacker use DNS open resolvers
by sending DNS requests with
source IP address of the target.
When Resolvers receive DNS
queries, they respond by DNS
responses to the target address.
Attacks of these types use
multiple DNS open resolvers so
the effects on the target devices
are magnified.
DNS ATTACKS 17
18. DNS CACHE POISONING
This technique can be used
to direct users of a website
to another site of the
attacker's choosing.
A user whose computer has
referenced the poisoned
DNS server would be tricked
into accepting content
coming from a non-
authentic server and
unknowingly download
malicious content.
DNS ATTACKS 18
19. DNS CACHE POISONING
1. Attacker poisons the cache
of Local DNS Server by either
remotely attacking or
breaking into the server.
2. Legitimate User tries to log
onto www.nicebank.com
3. DNS request to DNS server.
4. DNS server replies with IP of
fake website.
5. User is redirected to
www.n1cebank.com
DNS ATTACKS 19
20. (DDOS) DISTRIBUTED DENIAL OF
SERVICE
The attacker tries to target one or more of 13 DNS root name servers.
The root name servers are critical components of the Internet.
Attacks against the root name servers could, in theory, impact operation of
the entire global Domain Name System.
On October 21, 2002 an attack
lasting for approximately one
hour was targeted at all 13
DNS root name servers
On February 6, 2007 a similar
attack lasted twenty-four hours.
DNS ATTACKS 20
21. BIND9 SPOOFING
BIND is most widely used DNS software on Internet. BIND 9 (Stable
Production Release)
BIND 9 DNS queries are predictable (Source: bind-9-dns-cache-poisoning )
Source UDP port and DNS transaction ID can be effectively predicted.
BIND9 is found to be predictable to 10 choice.
This enables a much more effective DNS cache poisoning than the
currently known attacks against BIND 9.
DNS ATTACKS 21
22. HOW TO PREVENT DNS
ATTACKS?
DOMAIN NAME SYSTEM
DNS ATTACKS 22
23. HOW TO PREVENT DNS ATTACKS?
Band-Aid solutions
• Only cache information from authoritative servers
• Cross-check IP DNS mappings
• Transaction signatures for zone transfer, dynamic updates
• Split-split strategy: Advertising name server for DNS servers
• No cache to poison
• Only allow internal traffic
Firewalls can be utilized to minimize attacks against the DNS protocol.
• Query and Response Verification
• Transaction ID randomization
• DNS Header Flag Filtering
• DNS message size limitations
DNS ATTACKS 23
24. DNSSEC
DNS Security Extensions (DNSSEC)
• Adds security functions to the DNS protocol
• Can prevent some attacks like DNS cache poisoning.
• It adds data origin authentication and data integrity to DNS protocol.
• Digitally Sign DNS lookup using Public Key Crypto.
• DNSKEY record is authenticated via Chain of Trust starting with trusted
root.
• Its kind of SSL authentication for the DNS.
DNS ATTACKS 24
25. DNSSEC
1. RECORDS: RRSIG, DNSKEY, DS, NSEC and NSEC3
2. ALGORITHMS: RSA/MD5, DSA/SHA-1, RSA/SHA-256/512
3. LOOKUP PROCEDURE: Recursive Name Servers, Stub Resolver
4. TRUST ANCHORS AND AUTHENTICATION CHAIN
5. SIGNATURE AND ZONE SIGNING
6. KEY MANAGEMENT
DNS ATTACKS 25
26. HOW DNSSEC WORKS?
Stub
ns.utdallas.edu ns.dns.edu Root Server Recursor
Resolver
IP for www.utdallas.edu
Check Cache
Req DNSKEY Root
DNSKEY: KSKRoot +
RRSIG(KSKRoot) +
DNSKEY:ZSKroot +
RRSIG(ZSKroot)
Check RRSIG with KSKroot =>
Valid ZSKroot
IP for www.utdallas.edu
gotoNS:ns.dns.edu
DS(KSKedu) + RRSIG(DS)
NS:root + RRSIG(NS)
Check RRSIG with KSKroot =>
Valid DS(KSKedu)
Check RRSIG with KSKroot =>
Valid NS:root
DNS ATTACKS 26
27. HOW DNSSEC WORKS?
Stub
ns.utdallas.edu ns.dns.edu Root Server Recursor
Resolver
Check RRSIG with ZSKroot =>
Req DNSKEYedu Valid DS(KSKedu)
Check RRSIG with ZSKroot =>
Valid NS:root
DNSKEY: KSKorg +
RRSIG(KSKorg) +
DNSKEY:ZSKorg +
RRSIG(ZSKorg)
Validate KSKedu with DS(KSKedu)
=> Valid KSKedu
Check RRSIG with KSKedu
IP for www.utdallas.edu => Valid ZSKedu
gotoNS:ns.utdallas.edu
DS(KSKutd) + RRSIG(DS)
NS:ns.dns.edu + RRSIG(NS)
Check RRSIG with ZSKedu =>
Valid DS(KSKutd)
Check RRSIG with ZSKedu =>
Valid NS:ns.dns.edu
DNS ATTACKS 27
28. HOW DNSSEC WORKS?
Stub
ns.utdallas.edu ns.dns.edu Root Server Recursor
Resolver
Check RRSIG with ZSKedu =>
Req DNSKEYutd Valid DS(KSKutd)
Check RRSIG with ZSKedu =>
Valid NS:ns.dns.edu
DNSKEY: KSKutd +
RRSIG(KSKutd) +
DNSKEY:ZSKutd +
RRSIG(ZSKutd)
Validate KSKutd with DS(KSKutd)
=> Valid KSKutd
Check RRSIG with KSKutd
IP for www.utdallas.edu => Valid ZSKutd
A;123.123.123.123
RRSIG(A)
NS:ns.utdallas.edu + RRSIG(NS)
Check RRSIG with ZSKutd =>
Valid A record
Check RRSIG with ZSKutd =>
Valid NS:ns.utdallas.edu
A;123.123.123.123
DNS ATTACKS 28
29. DNSSEC STANDARDS
RFC4033 DNS Security Introduction and Requirements :
What is provided by DNSSEC? Origin Authentication and data integrity
• Resource Record Signature (RRSIG)
• DNS Public Key (DNSKEY)
• Delegation Signer (DS)
• Next Secure (NSEC)
• New Header bits: Checking Disabled (CD) and Authenticated Data (AD)
What is not provided by DNSSEC? Confidentiality, ACL, No protection against DoS attacks.
CONSIDERATIONS:
Resolver Cryptographic analysis on signatures, authentication chaining, validate DNS replies.
Stub Resolver DNSSEC validity checks, IPSec, setting of AD bit
Zones signed and unsigned zones, regular maintenance of RRset
Name Server DNSSEC records (RRSIG, DNSKEY, DS, and NSEC), EDNS "sender's UDP payload"
mechanism, private part of DNSSEC key pair should be kept offline
Security a channel secured by IPsec, DNS transaction authentication mechanism such as TSIG
DNS ATTACKS 29
30. DNSSEC STANDARDS
RFC4034 Resource Records for the DNS Security Extensions:
DNSKEY Resource Record
RRSIG Resource Record
NSEC Resource Record
DS Resource Record
RFC4035 Protocol Modifications for the DNS Security Extensions:
Zone Signing: DNSKEY, RRSIG, NSEC, DS
Serving : Authoritative Name Servers and Recursive Name Servers
Resolving : EDNS Support, Signature verification, trust anchors
Authenticating DNS Responses
RFC5155: DNSSEC Hashed Authenticated Denial of Existence
RFC4310: DNS Security Extensions Mapping for the Extensible Provisioning Protocol
(EPP)
RFC4641: DNSSEC Operational Practices
DNS ATTACKS 30
31. ARE WE SECURE WITH DNSSEC?
DNSSEC has some problems of its own:
Trivial Zone Configuration errors or expired keys can prove bad for DNSSEC-
aware resolver.
Increased size of DNSSEC response could encourage DoS amplifiers.
Slow response due to extra overhead of signature validation could result in
timeouts/re-queries. (Impatient DNS Clients)
Compromise in any of the zones between the root and target could
damage DNSSEC's ability to protect the integrity of data owned by that
target name
DNS ATTACKS 31
