Saving the Internet from doom (DNSSEC and IPv6) Sofia, Bulgaria September 2008
|
|
|
- Rolf Wright
- 7 years ago
- Views:
Transcription
1 Saving the Internet from doom (DNSSEC and IPv6) Sofia, Bulgaria September 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers
2 Agenda How do you attack the DNS? How does DNSSEC help this? Work IANA is doing on DNSSEC IPv6 and TLDs
3 How do you attack the DNS?
4 A typical DNS query
5 A typical DNS query aftld.org?
6 aftld.org? A typical DNS query
7 The DNS is not secure A computer sends a question to a DNS server, asking a question like What is the IP address for aftld.org? The computer gets an answer, and completely trusts that it is correct. There are multiple ways that traffic on the Internet can be intercepted and rerouted, or impersonated, so that the answer given is false.
8 Receiving the wrong answer Something in the network between the computer and the server has intercepted or redirected the traffic.
9 aftld.org? Receiving the wrong answer Something in the network between the computer and the server has intercepted or redirected the traffic.
10 aftld.org? Receiving the wrong answer Something in the network between the computer and the server has intercepted or redirected the traffic.
11 Receiving the wrong answer A server on the network responds with the wrong answer, quicker than the correct server can give the right answer.
12 aftld.org? Receiving the wrong answer A server on the network responds with the wrong answer, quicker than the correct server can give the right answer.
13 aftld.org? Receiving the wrong answer A server on the network responds with the wrong answer, quicker than the correct server can give the right answer.
14 aftld.org? Receiving the wrong answer A server on the network responds with the wrong answer, quicker than the correct server can give the right answer.
15 Cache poisoning If the answers are stored in a cache, the wrong answer gets remembered and served to future lookups. This is the typical configuration at ISPs, etc. One successful cache poisoning attack with therefore affect many users.
16 Cross pollination If the cache is also authoritative for a domain, it can also give the wrong answers for answers within that domain.
17 What do I do? Short term Do not offer open recursive name servers Definitely do not offer open recursive name servers that are also authorities at the same time Patch recursive name servers for maximum entropy (source port randomisation, etc.) Longer term Introduce security to the DNS...
18 What DNSSEC provides DNSSEC provides proof that the data has not been modified in transit from the DNS zone publisher (the registry) to the end-user It does this by providing additional information, something like a seal of origin, that can be verified as being correct or not.
19 aftld.org = centr.org = A DNSSEC secured transaction Check against a known set of signatures, and if there is a match, is a valid answer.
20 aftld.org? aftld.org = centr.org = A DNSSEC secured transaction Check against a known set of signatures, and if there is a match, is a valid answer.
21 aftld.org? aftld.org = centr.org = A DNSSEC secured transaction Check against a known set of signatures, and if there is a match, is a valid answer.
22 aftld.org? aftld.org = centr.org = A DNSSEC secured transaction Check against a known set of signatures, and if there is a match, is a valid answer.
23 Maintaining a list of signatures for every domain does not scale How could every computer maintain a list of every certificate for every domain it needs to verify? There needs to be a better way...
24 aftld.org = centr.org = iana.org? Using a chain of trusted certificates
25 aftld.org = centr.org = root.org = iana.org? Using a chain of trusted certificates
26 aftld.org = centr.org = root.org = iana.org? Using a chain of trusted certificates
27 aftld.org = centr.org = root.org = iana.org? org iana.org = Using a chain of trusted certificates
28 aftld.org = centr.org = root.org = iana.org? org iana.org = Using a chain of trusted certificates
29 aftld.org = centr.org = root = root.org = iana.org? org iana.org = Using a chain of trusted certificates
30 aftld.org = centr.org = root = root.org = iana.org? org iana.org = Using a chain of trusted certificates
31 aftld.org = centr.org = root = root.org = iana.org? org iana.org = Using a chain of trusted certificates
32 aftld.org = centr.org = root = root.org = iana.org? org iana.org = Using a chain of trusted certificates
33 The chain of trust By using the hierarchical property of the DNS, you can use DNSSEC to check certificates without knowing the certificate of every single domain Computers can learn certificates by tracing from a trusted key down the DNS delegation chain Of course, this only works if each level of the DNS deploys DNSSEC... For this to work, registries need to keep a list of signatures of its child zones, and publish them in their own signed zone
34 In summary: To deploy DNSSEC fully, zone managers need to: Sign their zone with a certificate Publish the certificates of their child zones Share their certificate with their parent zone The administration of these is much of the reason why DNSSEC has been difficult to deploy And why signing the root is considered so important it theoretically allows a single signature to verify the whole DNS!
35 Signing the root
36 IANA has been asked to sign the root zone Several entities have formally asked ICANN to sign the root zone (RIPE,.SE, APNIC) IANA has been signing the root experimentally for over a year However, as IANA does not directly publish the root, it can not currently make this a production service Working on obtaining permission from USDOC to let us sign the root zone
37 IPv6
38 IPv4 Availability Dwindling stocks...
39 IPv4 Availability Dwindling stocks...
40 IPv4 Availability Dwindling stocks...
41 IPv6 in a nutshell 128-bit address space 340,282,366,920,938,463,463,374,607,431,768,211,456 addresses IANA still has lots in reserve
42 All IPv6 Space ⅛th devoted to Unicast Divided into 512 /12 segments ARIN 1 RIPE NCC 1 AfriNIC 1 LACNIC 1 APNIC 1 Mixed 1 Unallocated 506 IPv6 Availability Approximately 1% of Unicast designated space is allocated to RIRs.
43 IPv6: the short story IPv4 address space is running out Current estimates, next couple of years IPv6 is the new numbering technology that will provide for growth of IP addressing needs The two numbering technologies are not mutually compatible, you must support IPv6 in addition to IPv4 to be accessible to IPv6 clients.
44 IPv6 adoption by TLD operators
45 IPv6 adoption by TLD operators 5 TLDs have 6 IPv6 authorities
46 IPv6 adoption by TLD operators 5 TLDs have 6 IPv6 authorities 11 TLDs have 5 IPv6 authorities
47 IPv6 adoption by TLD operators 5 TLDs have 6 IPv6 authorities 11 TLDs have 5 IPv6 authorities 5 TLDs have 4 IPv6 authorities
48 IPv6 adoption by TLD operators 5 TLDs have 6 IPv6 authorities 11 TLDs have 5 IPv6 authorities 5 TLDs have 4 IPv6 authorities 22 TLDs have 3 IPv6 authorities
49 IPv6 adoption by TLD operators 5 TLDs have 6 IPv6 authorities 11 TLDs have 5 IPv6 authorities 5 TLDs have 4 IPv6 authorities 22 TLDs have 3 IPv6 authorities 34 TLDs have 2 IPv6 authorities
50 IPv6 adoption by TLD operators 5 TLDs have 6 IPv6 authorities 11 TLDs have 5 IPv6 authorities 5 TLDs have 4 IPv6 authorities 22 TLDs have 3 IPv6 authorities 34 TLDs have 2 IPv6 authorities 49 TLDs have only 1 IPv6 authorities
51 IPv6 adoption by TLD operators 5 TLDs have 6 IPv6 authorities 11 TLDs have 5 IPv6 authorities 5 TLDs have 4 IPv6 authorities 22 TLDs have 3 IPv6 authorities 34 TLDs have 2 IPv6 authorities 49 TLDs have only 1 IPv6 authorities Would not meet IANA minimum diversity requirements for production deployment for IPv4
52 IPv6 adoption by TLD operators 5 TLDs have 6 IPv6 authorities 11 TLDs have 5 IPv6 authorities 5 TLDs have 4 IPv6 authorities 22 TLDs have 3 IPv6 authorities 34 TLDs have 2 IPv6 authorities 49 TLDs have only 1 IPv6 authorities Would not meet IANA minimum diversity requirements for production deployment for IPv4 155 TLDs have no IPv6 authorities at all!
53 Don t be a hindrance to IPv6 adoption Allow AAAA glue records in your zone Provide your zone over IPv6 transit Encourage registrars to allow AAAA glue records from registrants It is no use if your registry supports it, if your registrars do not. Registry support is bad, registrar support is worse!
54 Thanks!
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008
DNS Cache Poisoning Vulnerability Explanation and Remedies Viareggio, Italy October 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda How do you
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008
2008 DNS Cache Poisoning Vulnerability Cairo, Egypt November 2008 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers How does the DNS work? A typical DNS query The
Topics of Interest Iraklion, Greece June 2008
Topics of Interest Iraklion, Greece June 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers Agenda ICANN Budget for 2009 Interim Trust Anchor Repository
DNSSEC Explained. Marrakech, Morocco June 28, 2006
DNSSEC Explained Marrakech, Morocco June 28, 2006 Ram Mohan rmohan@afilias.info Agenda Getting Started Finding out what DNS does for you What Can Go Wrong A Survival Guide to DNSSEC Why Techies Created
Internet Operations and the RIRs
Internet Operations and the RIRs Overview ARIN and the Regional Internet Registry (RIR) System IP Number Resources, DNS and Routing IP Address Management Whois ARIN and the RIR System About ARIN One of
DNS Security FAQ for Registrants
DNS Security FAQ for Registrants DNSSEC has been developed to provide authentication and integrity to the Domain Name System (DNS). The introduction of DNSSEC to.nz will improve the security posture of
FAQ (Frequently Asked Questions)
FAQ (Frequently Asked Questions) Specific Questions about Afilias Managed DNS What is the Afilias DNS network? How long has Afilias been working within the DNS market? What are the names of the Afilias
IANA Functions to cctlds Sofia, Bulgaria September 2008
IANA Functions to cctlds Sofia, Bulgaria September 2008 Kim Davies Internet Assigned Numbers Authority Internet Corporation for Assigned Names & Numbers What is IANA? Internet Assigned Numbers Authority
DNS Basics. DNS Basics
DNS Basics 1 A quick introduction to the Domain Name System (DNS). Shows the basic purpose of DNS, hierarchy of domain names, and an example of how the DNS protocol is used. There are many details of DNS
The IANA Functions. An Introduction to the Internet Assigned Numbers Authority (IANA) Functions
The IANA Functions An Introduction to the Internet Assigned Numbers Authority (IANA) Functions Contents SECTION 1: INTRODUCTION 4 SECTION 2: POLICY, STAKEHOLDERS AND STEWARDSHIP IMPLEMENTATION 6 SECTION
Root zone update for TLD managers Mexico City, Mexico March 2009
Root zone update for TLD managers Mexico City, Mexico March 2009 Kim Davies Manager, Root Zone Services Internet Corporation for Assigned Names & Numbers A quick census 280 delegated 11 testing 280 delegated
NANOG DNS BoF. DNS DNSSEC IPv6 Tuesday, February 1, 2011 NATIONAL ENGINEERING & TECHNICAL OPERATIONS
NANOG DNS BoF DNS DNSSEC IPv6 Tuesday, February 1, 2011 NATIONAL ENGINEERING & TECHNICAL OPERATIONS The Role Of An ISP In DNSSEC Valida;on ISPs act in two different DNSSEC roles, both signing and valida;ng
Securing DNS Infrastructure Using DNSSEC
Securing DNS Infrastructure Using DNSSEC Ram Mohan Executive Vice President, Afilias rmohan@afilias.info February 28, 2009 Agenda Getting Started Finding out what DNS does for you What Can Go Wrong A Survival
Lesson 13: DNS Security. Javier Osuna josuna@gmv.com GMV Head of Security and Process Consulting Division
Lesson 13: DNS Security Javier Osuna josuna@gmv.com GMV Head of Security and Process Consulting Division Introduction to DNS The DNS enables people to use and surf the Internet, allowing the translation
Distributed Systems. 09. Naming. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 09. Naming Paul Krzyzanowski Rutgers University Fall 2015 October 7, 2015 2014-2015 Paul Krzyzanowski 1 Naming things Naming: map names to objects Helps with using, sharing, and communicating
Current Counter-measures and Responses by the Domain Name System Community
Current Counter-measures and Responses by the Domain Name System Community Paul Twomey President and CEO 22 April 2007 APEC-OECD Malware Workshop Manila, The Philippines 1 What I want to do today in 15
Computer Networks: Domain Name System
Computer Networks: Domain Name System Domain Name System The domain name system (DNS) is an application-layer protocol for mapping domain names to IP addresses DNS www.example.com 208.77.188.166 http://www.example.com
Before the. Committee on Energy and Commerce Subcommittee on Communications and Technology United States House of Representatives
Testimony of Fiona M. Alexander Associate Administrator, Office of International Affairs National Telecommunications and Information Administration United States Department of Commerce Before the Committee
Distributed Systems. 22. Naming. 2013 Paul Krzyzanowski. Rutgers University. Fall 2013
Distributed Systems 22. Naming Paul Krzyzanowski Rutgers University Fall 2013 November 21, 2013 2013 Paul Krzyzanowski 1 My 15 MacBook Pro The rightmost computer on my desk Paul s aluminum laptop, but
DNS and BIND. David White
DNS and BIND David White DNS: Backbone of the Internet Translates Domains into unique IP Addresses i.e. developcents.com = 66.228.59.103 Distributed Database of Host Information Works seamlessly behind
DNSSEC. Introduction. Domain Name System Security Extensions. AFNIC s Issue Papers. 1 - Organisation and operation of the DNS
AFNIC s Issue Papers DNSSEC Domain Name System Security Extensions 1 - Organisation and operation of the DNS 2 - Cache poisoning attacks 3 - What DNSSEC can do 4 - What DNSSEC cannot do 5 - Using keys
THE MASTER LIST OF DNS TERMINOLOGY. v 2.0
THE MASTER LIST OF DNS TERMINOLOGY v 2.0 DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To help people
The Internet. On October 24, 1995, the FNC unanimously passed a resolution defining the term Internet.
The Internet Introductory material. An overview lecture that covers Internet related topics, including a definition of the Internet, an overview of its history and growth, and standardization and naming.
Part 5 DNS Security. SAST01 An Introduction to Information Security 2015-09-21. Martin Hell Department of Electrical and Information Technology
SAST01 An Introduction to Information Security Part 5 DNS Security Martin Hell Department of Electrical and Information Technology How DNS works Amplification attacks Cache poisoning attacks DNSSEC 1 2
DNS Risks, DNSSEC. Olaf M. Kolkman and Allison Mankin. olaf@nlnetlabs.nl and mankin@psg.com. http://www.nlnetlabs.nl/ 8 Feb 2006 Stichting NLnet Labs
DNS Risks, DNSSEC Olaf M. Kolkman and Allison Mankin olaf@nlnetlabs.nl and mankin@psg.com 8 Feb 2006 Stichting NLnet Labs DNSSEC evangineers of the day Allison: Independent consultant Member of the Internet2
The Internet Introductory material.
The Internet Introductory material. An overview lecture that covers Internet related topics, including a definition of the Internet, an overview of its history and growth, and standardization and naming.
DNS Root NameServers
DNS Root NameServers An Overview Dr. Farid Farahmand Updated: 9/24/12 Who- is- Who! Over half million networks are connected to the Internet 5 billion users by 2015! Network numbers are managed by ICANN
Internet Bodies. Bernard.Tuy@renater.fr
Internet Bodies Bernard.Tuy@renater.fr Agenda Names, Acronyms in the Internet IETF organisation IESG, IAB, ISOC ICANN & IANA Standardisation process Standardisation compliance Internet Registries Requesting
Current Counter-measures and Responses by the Domain Name System Community
Current Counter-measures and Responses by the Domain Name System Community Paul Twomey President and CEO 22 April 2007 APEC-OECD Malware Workshop Manila, The Philippines 1 What we want you to do today
Internet-Praktikum I Lab 3: DNS
Kommunikationsnetze Internet-Praktikum I Lab 3: DNS Mark Schmidt, Andreas Stockmayer Sommersemester 2015 kn.inf.uni-tuebingen.de Motivation for the DNS Problem IP addresses hard to remember for humans
mydnsipv6 Success Story
Internet Identity For All mydnsipv6 Success Story By Norsuzana Harun Manager, Technology and Innovation Dept. 20 th July 2009 Agenda 1. About mydnsipv6 mydnsipv6 Roadmap (2006 2010) 2. mydnsipv6 Test Bed
THE MASTER LIST OF DNS TERMINOLOGY. First Edition
THE MASTER LIST OF DNS TERMINOLOGY First Edition DNS can be hard to understand and if you re unfamiliar with the terminology, learning more about DNS can seem as daunting as learning a new language. To
IPv6 Address Planning
eip604_v1.0 APNIC elearning: IPv6 Address Planning Contact: training@apnic.net Overview Where to Get IPv6 Addresses Addressing Plans ISP Infrastructure Addressing Plans Customer Example Address Plan Addressing
Q3 State of DNS Report DNSSEC Deployment in.gov
Q3 State of DNS Report DNSSEC Deployment in.gov September 22, 2010 Major findings 38% of federal.gov domains have been signed with DNSSEC as of mid- September 2010 36% of federal.gov domains are fully
ICANN- INTERNET CORPORATION OF ASSIGNED NAMES & NUMBERS
ICANN- INTERNET CORPORATION OF ASSIGNED NAMES & NUMBERS Prof.Vivekanandan MHRD IP CHAIR PROFESSOR National Academy of Legal Studies Research University (NALSAR) www.nalsarpro.org vivekvc2001@yahoo.co.in
Operation of the Root Name Servers
Operation of the Root Name Servers Lars-Johan Liman, i.root-servers.net John Crain, l.root-servers.net Suzanne Woolf, f.root-servers.net Bill Manning, b.root-servers.net Axel Pawlik, Rob Blokzijl, k.root-servers.net
An Introduction to the Domain Name System
An Introduction to the Domain Name System Olaf Kolkman Olaf@nlnetlabs.nl October 28, 2005 Stichting NLnet Labs This Presentation An introduction to the DNS Laymen level For non-technologists About protocol
Monitoring the DNS. Gustavo Lozano Event Name XX XXXX 2015
Monitoring the DNS Gustavo Lozano Event Name XX XXXX 2015 Agenda 1 2 3 Components of the DNS Monitoring gtlds Monitoring other components of the DNS 4 5 Monitoring system Conclusion 2 Components of the
Use Domain Name System and IP Version 6
Use Domain Name System and IP Version 6 What You Will Learn The introduction of IP Version 6 (IPv6) into an enterprise environment requires some changes both in the provisioned Domain Name System (DNS)
Strengthening our Ecosystem through Stakeholder Collaboration. Jia-Rong Low, Sr Director, Asia 20 August 2015
Strengthening our Ecosystem through Stakeholder Collaboration Jia-Rong Low, Sr Director, Asia 20 August 2015 Agenda 1 2 3 About ICANN and the Domain Name System (DNS) DNS attacks and their impact DNS Security
The Environment Surrounding DNS. 3.1 The Latest DNS Trends. 3. Technology Trends
3. The Environment Surrounding DNS DNS is used in many applications, serving as an important Internet service. Here we discuss name collision issues that have arisen with recent TLD additions, and examine
BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE
BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE BEST PRACTICES FOR IMPROVING EXTERNAL DNS RESILIENCY AND PERFORMANCE Your external DNS is a mission critical business resource. Without
A PKI For IDR Public Key Infrastructure and Number Resource Certification
A PKI For IDR Public Key Infrastructure and Number Resource Certification AUSCERT 2006 Geoff Huston Research Scientist APNIC If You wanted to be Bad on the Internet And you wanted to: Hijack a site Inspect
Presented by Greg Lindsay Technical Writer Windows Server Information Experience. Presented at: Seattle Windows Networking User Group April 7, 2010
Presented by Greg Lindsay Technical Writer Windows Server Information Experience Presented at: Seattle Windows Networking User Group April 7, 2010 Windows 7 DNS client DNS devolution Security-awareness:
Kim Davies Internet Assigned Numbers Authority
Introducing IANA Baltic Region and Eastern Europe International Seminar The Internet & the post-wsis environment: enhancing dialogue among the stakeholders Riga 2006 Kim Davies Internet Assigned Numbers
Copyright 2012 http://itfreetraining.com
In order to find resources on the network, computers need a system to look up the location of resources. This video looks at the DNS records that contain information about resources and services on the
DNS & IPv6. Agenda 4/14/2009. MENOG4, 8-9 April 2009. Raed Al-Fayez SaudiNIC CITC rfayez@citc.gov.sa, www.nic.net.sa. DNS & IPv6.
DNS & IPv6 MENOG4, 8-9 April 2009 Raed Al-Fayez SaudiNIC CITC rfayez@citc.gov.sa, www.nic.net.sa Agenda DNS & IPv6 Introduction What s next? SaudiNIC & IPv6 About SaudiNIC How a cctld Registry supports
Introduction to IP Numbers vs. Domain names. Adiel A. Akplogan CEO, AFRINIC. 2014
Introduction to IP Numbers vs. Domain names Adiel A. Akplogan CEO, AFRINIC. 2014 Identifying an IP address Internet identifiers including information about how to reach a network location (via the Internet
DNS. The Root Name Servers. DNS Hierarchy. Computer System Security and Management SMD139. Root name server. .se name server. .
Computer System Security and Management SMD139 Lecture 5: Domain Name System Peter A. Jonsson DNS Translation of Hostnames to IP addresses Hierarchical distributed database DNS Hierarchy The Root Name
Georgia College & State University
Georgia College & State University Milledgeville, GA Domain Name Service Procedures Domain Name Service Table of Contents TABLE OF REVISIONS... 3 SECTION 1: INTRODUCTION... 4 1.1 Scope and Objective...
How It Works: 101: Naming, Addressing, Routing ALAIN DURAND ICANN53 2015-06-21
How It Works: 101: Naming, Addressing, Routing ALAIN DURAND ICANN53 2015-06-21 Agenda Networking by Numbers Naming Addressing Routing 2 Networking by Numbers Layer 1 to layer 9 examples Layer 0: Physical
Ref: A. Leon Garcia and I. Widjaja, Communication Networks, 2 nd Ed. McGraw Hill, 2006 Latest update of this lecture was on 16 10 2010
IPv4 Addressing There are several non-profit organizations in the world that have the authority for assigning IP addresses to institutions that need access to the Internet. These organizations are (for
The secret life of a DNS query. Igor Sviridov <sia@nest.org> 20120522
The secret life of a DNS query Igor Sviridov 20120522 Preface Nowadays, when we type URL (or is it a search string? ;-) into a browser (or mobile device) many things happen. While most of
The Regional Internet Registries
The Regional Internet Registries Managing Internet Number Resources www.afrinic.net www.apnic.net www.arin.net www.lacnic.net www.ripe.net www.nro.net Global Coordination A Fair and Stable Platform Whether
Introduction to The Internet. ISP/IXP Workshops
Introduction to The Internet ISP/IXP Workshops 1 Introduction to the Internet Topologies and Definitions IP Addressing Internet Hierarchy Gluing it all together 2 Topologies and Definitions What does all
Introduction to The Internet
Introduction to The Internet ISP Workshops Last updated 5 September 2014 1 Introduction to the Internet p Topologies and Definitions p IP Addressing p Internet Hierarchy p Gluing it all together 2 Topologies
Security of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
DNS security: poisoning, attacks and mitigation
DNS security: poisoning, attacks and mitigation The Domain Name Service underpins our use of the Internet, but it has been proven to be flawed and open to attack. Richard Agar and Kenneth Paterson explain
Internet Structure and Organization
Internet Structure and Organization Resources management and allocation Bernard.Tuy@renater.fr Introduction What s the Internet? Why organizations / bodies are needed? Define protocol specifications Agree
IPv6 support in the DNS
IPv6 support in the DNS How important is the DNS? Getting the IP address of the remote endpoint is necessary for every communication between TCP/IP applications Humans are unable to memorize millions of
Law Enforcement and Internet Governance: An Ounce of Prevention Is Worth a Pound of Cure
Law Enforcement and Internet Governance: An Ounce of Prevention Is Worth a Pound of Cure Supervisory Special Agent Robert Flaim Federal Bureau of Investigation (FBI) Operational Technology Division Global
Defending your DNS in a post-kaminsky world. Paul Wouters <paul@xelerance.com>
Defending your DNS in a post-kaminsky world Paul Wouters Overview History of DNS and the Kaminsky attack Various DNS problems explained Where to address the DNS problem Nameservers,
How To Transition To Annia.Org From Aaa To Anora.Org
Version 1.0 27 JULY 2015 NUMBER COMMUNITY PROPOSAL OVERVIEW The Internet Number Community has a long-standing and straightforward operational relationship with IANA. IANA maintains the global pools of
Deploying DNSSEC: From End-Customer To Content
Deploying DNSSEC: From End-Customer To Content March 28, 2013 www.internetsociety.org Our Panel Moderator: Dan York, Senior Content Strategist, Internet Society Panelists: Sanjeev Gupta, Principal Technical
The Future of the Internet
The Future of the Internet Paul Twomey President and CEO 9 May 2007 IGF Internet Governance Workshop Tokyo, Japan 1 What I want to share with you today Brief introduction to ICANN Personal view of future
5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep)
5 DNS Security Risks That Keep You Up At Night (And How To Get Back To Sleep) survey says: There are things that go bump in the night, and things that go bump against your DNS security. You probably know
How To Stop A Malicious Dns Attack On A Domain Name Server (Dns) From Being Spoofed (Dnt) On A Network (Networking) On An Ip Address (Ip Address) On Your Ip Address On A Pc Or Ip Address
DNS Amplification Are YOU Part of the Problem? (RIPE66 Dublin, Ireland - May 13, 2013) Merike Kaeo Security Evangelist, Internet Identity merike@internetidentity.com INTRO Statistics on DNS Amplification
DNSSEC Deployment Activity in Japan - Introduction of DNSSEC Japan - Yoshiki Ishida, Yoshiro Yoneya, Tsuyoshi Toyono, Miki Takata DNSSEC Japan
DNSSEC Deployment Activity in Japan - Introduction of DNSSEC Japan - Yoshiki Ishida, Yoshiro Yoneya, Tsuyoshi Toyono, Miki Takata DNSSEC Japan Agenda Background Introduction of DNSSEC Japan Accomplishments
APNIC IPv6 Deployment
APNIC IPv6 Deployment Ulaanbaatar, Mongolia 19 October 2015 Issue Date: Revision: Overview Deployment motivation Network deployment IPv6 Services deployment IPv6 Anycast service IPv6 Cloud service Summary
DNSSEC: A Vision. Anil Sagar. Additional Director Indian Computer Emergency Response Team (CERT-In)
DNSSEC: A Vision Anil Sagar Additional Director Indian Computer Emergency Response Team (CERT-In) Outline DNS Today DNS Attacks DNSSEC: An Approach Countering DNS Attacks Conclusion 2 DNS Today DNS is
Regional Internet Registries. Statistics & Activities. Prepared By APNIC, ARIN, LACNIC, RIPE NCC
Regional Internet Registries Statistics & Activities Prepared By APNIC, ARIN, LACNIC, RIPE NCC IPv4 /8 Address Space Status Experimental 16 6.3% ARIN 16 6.3% LACNIC 1 0.4% APNIC 11 4.3% RIPE NCC 10 3.9%
How to use the UNIX commands for incident handling. June 12, 2013 Koichiro (Sparky) Komiyama Sam Sasaki JPCERT Coordination Center, Japan
How to use the UNIX commands for incident handling June 12, 2013 Koichiro (Sparky) Komiyama Sam Sasaki JPCERT Coordination Center, Japan Agenda Training Environment Commands for incident handling network
DNS Protocol and Attacks
Lecture Notes (Syracuse University) DNS Protocol and Attacks: 1 DNS Protocol and Attacks An interesting story related to DNS In the 2004 presidential debate between John Edward and the vice president Dick
DNSSEC Applying cryptography to the Domain Name System
DNSSEC Applying cryptography to the Domain Name System Gijs van den Broek Graduate Intern at SURFnet Overview First half: Introduction to DNS Attacks on DNS Second half: DNSSEC Questions: please ask! DNSSEC
What's inside the cloud?!
What's inside the cloud?! Initial Arpanet Initial Arpanet Interface Message Processors - DDP-516 mini-computers - 24 Kbyte of Core memory - Store-and-forward packet switching - Predecessors of present
NET0183 Networks and Communications
NET0183 Networks and Communications Lecture 25 DNS Domain Name System 8/25/2009 1 NET0183 Networks and Communications by Dr Andy Brooks DNS is a distributed database implemented in a hierarchy of many
SAC 049 SSAC Report on DNS Zone Risk Assessment and Management
SAC 049 SSAC Report on DNS Zone Risk Assessment and Management A Report from the ICANN Security and Stability Advisory Committee (SSAC) 03 June 2011 SAC049 1 Preface This is a Report of the Security and
IPV6 SERVICES DEPLOYMENT
IPV6 SERVICES DEPLOYMENT LINX IPv6 Technical Workshop - March 2009 Jaco Engelbrecht Group Platforms Manager, clara.net DNS root zone goes AAAA! On 4 th February 2008 IANA added AAAA records for the A,
Innovating with the Domain Name System: From Web to Cloud to the Internet of Things
Innovating with the Domain System: From Web to Cloud to the Internet of Things Dr. Burt Kaliski, Jr. Senior Vice President, Chief Technology Officer WHD.Asia 2014 September 2, 2014 Agenda Ecosystem Innovations
Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce. Domain Name System
Computer Networks: DNS a2acks CS 1951e - Computer Systems Security: Principles and Prac>ce 18/02/15 Networks: DNS attacks 1 Domain Name System The domain name system (DNS) is an applica>on- layer protocol
Measuring IPv6 Deployment. Geoff Huston APNIC December 2009
Measuring IPv6 Deployment Geoff Huston APNIC December 2009 IPv4 address exhaustion Total Address Count Adver0sed Count IANA Pool Unadver0sed Count IPv4 address exhaustion The model of address consumption
DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment
DNSSEC - Why Network Operators Should Care And How To Accelerate Deployment Dan York, CISSP Senior Content Strategist, Internet Society Eurasia Network Operators' Group (ENOG) 4 Moscow, Russia October
Glossary of Technical Terms Related to IPv6
AAAA Record An AAAA record stores a 128-bit Internet Protocol version 6 (IPv6) address, which does not fit the standard A record format. For example, 2007:0db6:85a3:0000:0000:6a2e:0371:7234 is a valid
STATE OF DNS AVAILABILITY REPORT
STATE OF DNS AVAILABILITY REPORT VOLUME 1 ISSUE 1 APRIL 2011 WEB SITES AND OTHER ONLINE SERVICES ARE AMONG THE MOST IMPORTANT OPERATIONAL AND REVENUE GENERATING TOOLS FOR BUSINESSES OF ALL SIZES AND INDUSTRIES.
DNS at NLnet Labs. Matthijs Mekking
DNS at NLnet Labs Matthijs Mekking Topics NLnet Labs DNS DNSSEC Recent events NLnet Internet Provider until 1997 The first internet backbone in Holland Funding research and software projects that aid the
Namecoin as alternative to the Domain Name System
Namecoin as alternative to the Domain Name System Xander Lammertink Author, UvA System and Network Engineering xander.lammertink@os3.nl Marco Davids Supervisor, SIDN Labs Abstract: This paper researches
OVERVIEW OF THE DNS AND GLOSSARY OF TERMS
OVERVIEW OF THE DNS AND GLOSSARY OF TERMS OVERVIEW OF THE DNS AND GLOSSARY OF TERMS The DNS is a technology that most IT managers don t think much about; it works well and usually does not require much
DNS traffic analysis -- Issues of IPv6 and CDN --
DNS traffic analysis -- Issues of IPv6 and CDN -- Kazunori Fujiwara ^, Akira Sato, Kenichi Yoshida University of Tsukuba ^Japan Registry Services Co., Ltd (JPRS) July 29, 2012 IEPG meeting at Vancouver
OVERVIEW OF THE DNS AND GLOSSARY OF TERMS
PROTECT YOUR BUSINESS D-Zone Anycast DNS Service OVERVIEW OF THE DNS AND GLOSSARY OF TERMS 1 PROTECT YOUR BUSINESS OVERVIEW OF THE DNS AND GLOSSARY OF TERMS The DNS is a technology that most IT managers
DOMAIN NAME SECURITY EXTENSIONS
DOMAIN NAME SECURITY EXTENSIONS The aim of this paper is to provide information with regards to the current status of Domain Name System (DNS) and its evolution into Domain Name System Security Extensions
Introduction to Network Operating Systems
As mentioned earlier, different layers of the protocol stack use different kinds of addresses. We can now see that the Transport Layer (TCP) uses port addresses to route data to the correct process, the
An introduction to IANA Presentation Notes
An introduction to IANA Presentation Notes Date 29 September 2008 Contact Kim Davies, Manager of Root Zone Services kim.davies@icann.org While the Internet is renowned for being a worldwide network free
The Domain Name System
DNS " This is the means by which we can convert names like news.bbc.co.uk into IP addresses like 212.59.226.30 " Purely for the benefit of human users: we can remember numbers (e.g., telephone numbers),
Response to Solicitation Number: SA-13-01-6R-P0-016
Response to Solicitation Number: SA-13-01-6R-P0-016 Offered by: Internet Corporation for Assigned Names and Numbers 4676 Admiralty Way, Suite 330 Marina del Rey, CA 90292 USA +1-310-823-9358 (tel) +1-310-823-8649
IPv6 Addressing and Subnetting
APNIC elearning: IPv6 Addressing and Subnetting Contact: training@apnic.net eip602_v1.0 Overview IPv6 Address Text Representation IPv6 Addressing Structure IPv6 Address Management Hierarchy Local Addresses
Where is Hong Kong in the secure Internet infrastructure development. Warren Kwok, CISSP Internet Society Hong Kong 12 August 2011
The Internet is for Everyone. Become an ISOC Member. Cyber Security Symposium 2011 Where is Hong Kong in the secure Internet infrastructure development Warren Kwok, CISSP Internet Society Hong Kong 12
IPv6Program. Expanding the Internet. The IPv4 to IPv6 transition
IPv6Program Expanding the Internet The IPv4 to IPv6 transition IP addresses: critical Internet resources Internet Protocol (IP) addresses are the means by which machines uniquely identify themselves on
Chapter 25 Domain Name System. 25.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display.
Chapter 25 Domain Name System 25.1 Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. 25.2 Figure 25.1 Example of using the DNS service 25-1 NAME SPACE To be unambiguous,
USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION
USING TRANSACTION SIGNATURES (TSIG) FOR SECURE DNS SERVER COMMUNICATION Transaction Signatures (TSIG) provide a secure method for communicating in the Domain Name System (DNS) from a primary to a secondary
Network measurement II. Sebastian Castro NZRS 27 th May 2015 Victoria University
Network measurement II Sebastian Castro NZRS 27 th May 2015 Victoria University Agenda Network measurement in the wild Common pitfalls in methodologies Network measurement datasets Stories Our work AMP