CIT 480: Securing Computer Systems. DNS Security

Transcription

1 CIT 480: Securing Computer Systems DNS Security

2 Topics 1. How DNS Works 2. DNS Caching 3. Pharming 4. DNS Cache Poisoning 5. DNS Cache Defenses 6. DNSSEC

3 Domain Name System (DNS) The domain name system (DNS) is an application-layer protocol for mapping domain names to IP addresses DNS My Example Blog Spot My Example Blog Spot Vacation Savings Vacation Savings

4 Domain Name System DNS provides a distributed database over the internet that stores various resource records, including: Address (A) record: IP address associated with a host name Mail exchange(mx) record: mail server of a domain Name server (NS) record: authoritative server for a domain Example DNS entries from

5 Name Servers Domain names: Two or more labels, separated by dots (e.g., cs166.net) Rightmost label is the top-level domain (TLD) Hierarchy of authoritative name servers Information about root domain Information about its subdomains (A records) or references to other name servers (NS records) The authoritative name server hierarchy matches the domain hierarchy: root servers point to DNS servers for TLDs, etc. Root and TLD servers change infrequently. DNS servers refer to other DNS servers by name, not by IP: sometimes must bootstrap by providing an IP along with a name, called a glue record.

6 DNS Tree com edu google.com microsoft.com... stanford.edu brown.edu A google.com A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### A xxx.google.com ########### Amicrosoft.com A stanford.edu A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A xxx.stanford.edu ###.### A brown.edu cs.brown.edu A cs.brown.edu A xxx.brown.edu ### A xxx.brown.edu ### A xxx.brown.edu ### A xxx.brown.edu ### A xxx.brown.edu ### A xxx.brown.edu ### A xxx.brown.edu ### A xxx.brown.edu ### A xxx.brown.edu ### resource records

7 Internet Corporation for Assigned Names and Numbers Non-profit organization at USC that Manages root DNS servers Allocates IP addresses Originally created and run by US government Controversial in EU, China, UN Independent as of Sept 30, 2009 Alternative to ICANN Multiple DNS trees with their own roots Name resolution varies based on geography

8 Top Level Domains Generic TLDs (gtlds) cctlds Suffix Purpose Example com Commercial organizations (businesses) intel.com edu Educational organizations (universities) nku.edu gov Government organizations kentucky.gov mil Military organizations army.mil net Networking organizations (ISPs) sprint.net org Noncommercial organizations ietf.org int International organizations nato.int info Informational sites cat.info at Country code for Austria austria.at uk Country code for United Kingdom bbc.co.uk us Country code for United States gov.state.ky.us

9 Name Resolution Zone: collection of connected nodes with the same authoritative DNS server, e.g. nku.edu. Resolution method when answer not in cache: ISP DNS Server Where is Try com nameserver root name server Client Where is Where is com name server Try example.com nameserver Where is example.com name server

10 DNS Query Packet 10

11 DNS Response Packet 11

12 Authoritative Name Servers Control of the DNS is distributed among authoritative name servers (ANSs) ANS are responsible for specific domains. Can designate other ANS for subdomains. ANS can be master or slave Master contains original zone table. Slaves are replicas, automatically updating. Fault tolerance + load balancing. Set Authoritative Answer (AA) flag in responses.

13 DNS Lookup Activity 1. dig 1. What is the IP address? 2. What are the nameservers for nku.edu? 2. dig +trace 1. List each element of the DNS tree queried. 2. What does the first result from each tree element tell you? 3. Lookup in the same ways. 13

14 Dynamic Resolution Many large providers have more than one authoritative name server for a domain Problem: need to locate the instance of domain geographically closest to user Proposed solution: include first 3 octets of requester's IP in recursive requests to allow better service Content distribution networks like Akamai already do adaptive DNS routing

15 DNS Caching Too much network traffic required to traverse DNS tree for each query Root zone would be rapidly overloaded. DNS servers cache results for a specified amount of time Specified by ANS reply's time-to-live (TTL) field. Domain admin determines TTL based on how often changes. OS and browsers maintain resolvers and DNS caches View DNS servers in Windows with ipconfig /displaydns View DNS servers Linux with cat /etc/resolv.conf Privacy issues: DNS cache reveals which sites you visited. DNS queries are typically issued over UDP on port bit query identifier (QID) in payload ties response to request. Responses whose QIDs do not match pending requests are ignored.

16 DNS Caching Step 1: query yourdomain.org Local Machine Local NS Application Resolver query Resolver query Authoritative Name Server cache cache Step 2: receive reply and cache at local NS and host Local Machine Local NS Application Resolver answer Resolver answer Authoritative Name Server cache cache

17 DNS Caching (con'd) Step 3: use cached results rather than querying the ANS Local Machine 1 Local NS Application Resolver Resolver Local Machine 2 cache query cache Application Resolver answer cache Step 4: Evict cache entries upon TTL expiration

18 Pharming: DNS Hijacking Changing IP associated with a server maliciously Normal DNS Pharming attack My Premium Blog Spot My Premium Blog Spot userid: password: userid: password: Phishing: the different web sites look the same.

19 Pharming Attack Vectors 1. Malware modifies host name resolution. 1. Rewrite addresses in local hosts file. 2. Rewrite addresses of DNS servers. 2. Attacker subverts DHCP server, configures it to return malicious DNS servers. 1. Target DHCP server on home router. 2. Target DHCP server at ISP or corporate network. 19

20 DNS Cache Poisoning Send DNS servers false responses that will be cached. Fake response maps valid name to malicious IP address. Fake response has new authoritative nameserver, which is controlled by threat, in glue records. False responses must have Same UDP destination port as query UDP source port. Same Question as a pending request. QID that matches that of pending request. DNS server accepts first response to question. If malicious response first, then its result is used + cached.

21 QID Guessing Network sniffer if on same subnet. Wait for request and observe QID from packet. Some servers have predictable QIDs Lure user to click on link to site whose domain you control. When attacker DNS server is contacted, record QID. Increment QID to match QID of next query. Mass guessing Send multiple responses with different QIDs to same query. Birthday paradox math requires a few hundred responses.

22 DNS Cache Poisoning Prevention Use random identifiers for queries Attacker must brute force 16-bit QID, which requires thousands of responses, but is doable. Port randomization for DNS requests Attacker must guess 16-bit port as well as query. Harder, but successful attacks observed. Deploy DNSSEC Signed updates cannot be spoofed, but Not yet deployed widely.

23 Guarantees: DNSSEC Authenticity of DNS answer origin. Integrity of reply. Does not protect confidentiality. Digital signatures of DNS replies. Uses a chain of trust model like SSL. Trust anchors built into OS give starting point like root CA certificates in web browsers.

24 DNS Signing

25 Deployed at root in 2010 DNSSEC Allows use of root servers as trust anchors..com uses DNSSEC since br,.pr,.se, and some other cctlds use DNSSEC. Political issues Concern about US control over root servers. Some governments might ban DNSSEC-based encryption key distribution to enable surveillance.

26 Key Points 1. DNS maps names to IP addresses 1. DNS tree structure and how names are paths. 2. Name resolution process. 3. Pharming attacks take control of DNS servers to map names of legitimate sites to malicious ones. 2. DNS caching 1. Multiple levels: OS, browser, ISP, etc. 2. Threat can poison caches by sending malicious responses to query with correct Question and QID of original query. 3. DNSSEC protects integrity of responses. 1. Blocks DNS cache poisoning attacks. 26

27 References 1. Steve Friedl, An Illustrated Guide to the Kaminsky DNS Vulnerability, Goodrich and Tammasia, Introduction to Computer Security, Pearson,