Sergei Komarov
Mechanism for IP <> hostname resolution
 Globally distributed database
 Hierarchical structure
 Comprised of three components
A “name space”
Servers making that name space available
Resolvers (clients) which query the servers
about the name space
Name servers answer ‘DNS’ questions,
give authoritative answers for one or more
 Several types of name servers
 Authoritative servers
○ master (primary)
 The master server normally loads the data from a zone
○ slave (secondary)
 A slave server normally replicates the data from the
master via a zone transfer
 (Caching) recursive servers
○ also caching forwarders
DNS zones & domains
Zone - sub-tree of a larger tree identified by a domain name,
contains resource records and sub-domains
DNS Records
‘A’ record
 Defines a host, contains IPv4 address
‘AAAA’ record
 Defines a host, contains IPv6 address
‘MX’ record
 Defines mail servers for particular domain
‘NS’ record
 authoritative nameservers for domain
‘CNAME’ Record
 Alias
DNS Security Vulnerabilities
Packet Sniffing
 DNS queries/responses come unsigned and
unencrypted as one packet
Transaction ID guessing
 A 16-bit field identifying a specific DNS
transaction. The transaction ID is created by the
message originator. Using the transaction ID,
the DNS client can match responses to its
Caching problems
 No fast & secure way of propagating updates
and invalidations
DNS Security Vulnerabilities
Information Leakage
 Zone transfer not configured correctly
 Result: anyone can query the nameserver
DNS Dynamic Update Vulnerabilities
 e.g. DHCP uses DNS Dynamic Updates to
add/delete RRs on demand
 Authenication takes place on the primary server
of the zone, based on the IP address, which
could be spoofed
BIND Security
 Old versions still in use extensively
DNS Security Attacks
MITM(Man in the Middle Attacks)
 The attacker makes connections with the
victims and relays messages between them,
making them believe that they are talking
directly to each other over a private
 In DNS only IP address, ports and Query ID
of source can be verified, but this is easy to
DNS Security Attacks
Cache Poisoning using Name Chaining
 Victim issues a query
 Atacker injects DNS names into the response of
RR’s and can reroute subsequent DNS queries
to another server
 This is achieved by means of DNS
RRs(resource records) whose RDATA portion
includes a DNS name which can be used as a
hook to let an attacker feed bad data into a
victim’s cache.
 The most affected types of RRs are CNAME,
NS, and DNAME(alias for the whole DNS
domain) RRs.
DNS Security Attacks
Cache Poisoning using Transaction ID
 Transaction ID field is only a 16-bit field
 There are only 232 possible combinations of
ID and client UDP ports
 Some transaction ID generators are flawed,
can be predicted
 Adds new records:
○ Origin authentication
○ Transaction authentication
○ Request authentication
Each secured zone has a key pair
 Public key, stored as a resource record (type KEY) in the
secured zone. The public key is used by DNS servers and
Resolvers to verify the zone’s digital signature.
 A private key is used to sign a RRset. If data is modified during
transport the signature is no longer valid.
 Nothing is encrypted, only signatures are used.
Easy to implement if hardware support present
Has been around for years
DNS Attacks

similar documents