DNS Lecture 12 - cs.auckland.ac.nz
16
DNS Lecture 12 COMPSCI 726 Network Defence and Countermeasures Source of some slides: Princeton University, Cornell University, and Stanford University Nalin Asanka Gamagedara Arachchilage August 12, 2021 Slides from Muhammad Rizwan Asghar
Transcript of DNS Lecture 12 - cs.auckland.ac.nz
Slide titleIn CAPITALS
50 pt
Slide subtitle 32 pt
DNSLecture 12COMPSCI 726
Network Defence and Countermeasures
Source of some slides: Princeton University, Cornell University, and Stanford University
Nalin Asanka Gamagedara Arachchilage
August 12, 2021
Slides from Muhammad Rizwan Asghar
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
2
HOSTNAME VS IP ADDRESSE
§ Host names– Mnemonic name appreciated by humans
– Variable length, alphanumeric characters
– Examples: www.cnn.com and nzherald.co.nz
§ IP addresses– Numerical address processed by routers
– Fixed length, binary number
– Hierarchical, related to host location
– Examples: 64.236.16.20 and 193.30.227.161
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
3
DOMAIN NAME SYSTEM (DNS)
§ Properties of DNS– Hierarchical name space divided into zones– Distributed over a collection of DNS servers
§ Hierarchy of DNS servers– Root DNS servers– Top-Level Domain (TLD) DNS servers– Authoritative DNS servers
§ For performing translations– Local DNS servers– Resolver software (client end)
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
4
HIERARCHICAL NAME SPACE
root
edunetorg ukcom nz
stanford ucb myuni cmu mit
cs ee
www
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
5
AUTHORITATIVE VS NON-AUTHORITATIVE ANSWER
§ An authoritative answer from a name server is “guaranteed” to be accurate
§ A non-authoritative answer may not be accurate
– Such as an answer from the cache
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
6
DNS PROTOCOL
§ DNS has two types of messages: Query and response
§ 16-bit random value links response to a query ID
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
7
DNS RESOLUTION
Requesting hostcis.myuni.edu
www.cs.yours.edu
Local DNS serverdns.myuni.edu
1
23
4
5
6
Authoritative DNS serverdns.cs.yours.edu
78
TLD DNS server
Root DNS server
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
8
DNS RESOURCE RECORD (RR)
§ RR format– (Name, value, type, TTL)
§ Name and value for hostname and IP address
§ Type – A means hostname– NS means name server– M means canonical name– MX means mail server
§ TTL (Time To Live)§ There may be multiple records returned for one query
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
9
DNS CACHING
§ Caching can substantially reduce overhead– The top-level servers very rarely change– Popular sites are visited often– Local DNS server often has the information cached
§ How DNS caching works– DNS servers cache responses to queries– Response includes a TTL field– The server deletes the cached entry after TTL expires
§ DNS negative queries are cached– Save time for non-existent sites, e.g., misspelling
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
10
DNS CACHE POISIONING ATTACK
§ Basic idea: Give DNS servers a false record and get it cached
§ Cache may be poisoned when a name server:– Disregards identifiers– Has predictable ID in query– Accepts unsolicited DNS records
§ Some DNS server implementations do not validate the authority of a responder!
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
11
DNS CACHE POISIONING ATTACK
UserBrowser
LocalDNS
Resolver
Query:QID=xa.bank.com
Attacker
256 responses:Random QID y1, y2, …NS bank.com=ns.bank.comA a.bank.com=attackerIPAttacker wins if $j: x = yj
Response is cached andattacker owns a.bank.com
ns.bank.comIPaddr
Success after » 256 tries
Query:QID=xa.bank.com
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
12
DNS CACHE POISIONING PREVENTION
§ Always check identifiers
§ Make it hard to guess identifiers for queries (QID)
– Use random QID
– Increase size of QID
§ Port randomisation for DNS requests
§ Ask DNS query twice
§ Deploy DNSSEC
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
13
SOME TOOLS
§ dig
§ host
§ nslookup
§ whois
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
14
SUMMARY
§ DNS provides a hierarchical name space
§ DNS is vulnerable to cache poisoning
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
15
RESOURCES
§ DNS.Available at: https://www.ietf.org/rfc/rfc1034.txtAvailable at: https://www.ietf.org/rfc/rfc1035.txt
Top right corner for fieldcustomer or partner logotypes. See Best practice for example.
Slide title 40 pt
Slide subtitle 24 pt
Text24 pt
520 pt
16
Questions?
Thanks for your attention!
