Assessing DNS Vulnerability to Record Injection Kyle Schomp , Tom - - PowerPoint PPT Presentation

▶
assessing dns vulnerability
SMART_READER_LITE
LIVE PREVIEW

Assessing DNS Vulnerability to Record Injection Kyle Schomp , Tom - - PowerPoint PPT Presentation

Sep 21, 2023 646 likes •1.3k views

Assessing DNS Vulnerability to Record Injection Kyle Schomp , Tom Callahan, Michael Rabinovich , Mark Allman Case Western Reserve University International Computer Science Institute Passive and Active Measurement Conference

slide-1
SLIDE 1

Assessing DNS Vulnerability to Record Injection

Kyle Schomp†, Tom Callahan†, Michael Rabinovich†, Mark Allman†‡

†Case Western Reserve University ‡International Computer Science Institute Passive and Active Measurement Conference 2014

3/11/2014 PAM 2014 1

slide-2
SLIDE 2

3/11/2014 PAM 2014 2

slide-3
SLIDE 3

DNS Recording Injection

  • Subverting the DNS name to address bindings can result in:
  • Redirection to a malicious webserver
  • Privacy issues
  • Denial of service
  • Phishing attacks
  • Malware installation

3/11/2014 PAM 2014 3

slide-4
SLIDE 4

Our Contribution

  • Assess vulnerability to extraneous record injection
  • Bailiwick violations
  • Examine the incidence rate of intentional response rewriting by

resolvers

  • Negative response rewriting
  • Search engine hijacking (Paxfire)
  • Survey use of established mitigations to the Kaminsky vulnerability
  • Demonstrate a new record injection attack (the Preplay vulnerability)

3/11/2014 PAM 2014 4

slide-5
SLIDE 5
  • Discover open resolvers by sampling randomly from the Internet
  • Deploy our own authoritative DNS server (ADNS)
  • DNS request probes target our own domain
  • Test open and egress resolvers for vulnerability to record injection

Dataset Collection Methodology

3/11/2014 PAM 2014 5

Open Resolver Egress Resolver Scanner ADNS for dnsresearch.us

slide-6
SLIDE 6
  • Discover open resolvers by sampling randomly from the Internet
  • Deploy our own authoritative DNS server (ADNS)
  • DNS request probes target our own domain
  • Test open and egress resolvers for vulnerability to record injection

Dataset Collection Methodology

3/11/2014 PAM 2014 5

Open Resolver Scanner ADNS for dnsresearch.us “RDNS”, Recursive Resolver

slide-7
SLIDE 7
  • Discover open resolvers by sampling randomly from the Internet
  • Deploy our own authoritative DNS server (ADNS)
  • DNS request probes target our own domain
  • Test open and egress resolvers for vulnerability to record injection

Dataset Collection Methodology

3/11/2014 PAM 2014 5

“FDNS”, Forwarding Resolver Scanner ADNS for dnsresearch.us “RDNS”, Recursive Resolver

slide-8
SLIDE 8
  • Discover open resolvers by sampling randomly from the Internet
  • Deploy our own authoritative DNS server (ADNS)
  • DNS request probes target our own domain
  • Test open and egress resolvers for vulnerability to record injection

Dataset Collection Methodology

3/11/2014 PAM 2014 5

“FDNS”, Forwarding Resolver ADNS for dnsresearch.us “RDNS”, Recursive Resolver Client

slide-9
SLIDE 9

Bailiwick Violations

  • Over 10 years old
  • Mitigated via the bailiwick rules
  • 749 violations found in 1.09M
  • pen resolvers tested
  • Some resolvers still vulnerable to

this very old attack!

3/11/2014 PAM 2014 6

Query www.x.com ? Answer 1.2.3.4 Additional www.hsbc.com A 2.3.4.5 www.x.com ? RDNS ADNS for x.com

slide-10
SLIDE 10

Negative Response Rewriting

3/11/2014 PAM 2014 7

anazon.com ? anazon.com ? RDNS Client ADNS for x.com

slide-11
SLIDE 11

Negative Response Rewriting

3/11/2014 PAM 2014 7

anazon.com ? does not exist anazon.com ? RDNS Client ADNS for x.com

slide-12
SLIDE 12

Negative Response Rewriting

3/11/2014 PAM 2014 7

anazon.com ? does not exist anazon.com ? anazon.com = A RDNS Client ADNS for x.com

slide-13
SLIDE 13

Negative Response Rewriting

  • Why? DNS provider profits from advertising at A
  • Happens to 24% of open resolvers

3/11/2014 PAM 2014 7

anazon.com ? does not exist anazon.com ? anazon.com = A RDNS Client ADNS for x.com

slide-14
SLIDE 14

Search Engine Hijacking (Paxfire)

3/11/2014 PAM 2014 8

www.google.com ? www.google.com ? ADNS for google.com RDNS

slide-15
SLIDE 15

Search Engine Hijacking (Paxfire)

3/11/2014 PAM 2014 8

www.google.com ? www.google.com = G www.google.com ? ADNS for google.com RDNS

slide-16
SLIDE 16

Search Engine Hijacking (Paxfire)

3/11/2014 PAM 2014 8

www.google.com ? www.google.com = G www.google.com ? www.google.com = A ADNS for google.com RDNS

slide-17
SLIDE 17

Search Engine Hijacking (Paxfire)

3/11/2014 PAM 2014 8

www.google.com ? www.google.com = G www.google.com ? www.google.com = A ADNS for google.com RDNS A G

slide-18
SLIDE 18

Search Engine Hijacking (Paxfire)

3/11/2014 PAM 2014 8

www.google.com ? www.google.com = G www.google.com ? www.google.com = A search result ADNS for google.com RDNS A G

slide-19
SLIDE 19

Search Engine Hijacking (Paxfire)

3/11/2014 PAM 2014 8

www.google.com ? www.google.com = G www.google.com ? www.google.com = A search result ADNS for google.com RDNS A G

slide-20
SLIDE 20

Search Engine Hijacking (Paxfire)

  • Again, the primary reason is to monetize user’s search traffic
  • While once common, this is no longer a widespread practice

3/11/2014 PAM 2014 8

www.google.com ? www.google.com = G www.google.com ? www.google.com = A search result ADNS for google.com RDNS A G

slide-21
SLIDE 21

Off-path Attacks

  • Craft an acceptable DNS response to squeeze between the real DNS

request and response

3/11/2014 PAM 2014 9

slide-22
SLIDE 22

Off-path Attacks

  • Craft an acceptable DNS response to squeeze between the real DNS

request and response

3/11/2014 PAM 2014 9

real request Resolver

slide-23
SLIDE 23

Off-path Attacks

  • Craft an acceptable DNS response to squeeze between the real DNS

request and response

3/11/2014 PAM 2014 9

malicious response real request Resolver

slide-24
SLIDE 24

Off-path Attacks

  • Craft an acceptable DNS response to squeeze between the real DNS

request and response

3/11/2014 PAM 2014 9

real response malicious response real request Resolver

slide-25
SLIDE 25

Off-path Attacks

  • Craft an acceptable DNS response to squeeze between the real DNS

request and response

  • Fields to match:
  • IP addresses: source and destination
  • Port numbers: source and destination
  • Query string and transaction ID

3/11/2014 PAM 2014 9

real response malicious response real request Resolver

slide-26
SLIDE 26

Kaminsky Vulnerability

  • In 2008, Dan Kaminsky discovered a new vulnerability
  • 2 keys to Kaminsky
  • Transaction ID is the only field the attacker needs to guess
  • Simple way to attempt multiple guesses
  • Kaminsky showed that a cache could be poisoned in under 10

minutes!

3/11/2014 PAM 2014 10

slide-27
SLIDE 27

Kaminsky Vulnerability (cont.)

3/11/2014 PAM 2014 11

Attacker RDNS ADNS for victim.com

slide-28
SLIDE 28

Kaminsky Vulnerability (cont.)

3/11/2014 PAM 2014 11

x1.victim.com ? TID=y Attacker RDNS ADNS for victim.com

slide-29
SLIDE 29

Kaminsky Vulnerability (cont.)

3/11/2014 PAM 2014 11

x1.victim.com ? TID=y answer TID=y Attacker RDNS ADNS for victim.com

slide-30
SLIDE 30

Kaminsky Vulnerability (cont.)

3/11/2014 PAM 2014 11

x1.victim.com ? TID=y answer TID=y Attacker RDNS ADNS for victim.com

slide-31
SLIDE 31

Kaminsky Vulnerability (cont.)

Query x1.victim.com ? Answer doesn’t matter Authority victim.com NS ns1.victim.com Additional ns1.victim.com A attacker

3/11/2014 PAM 2014 11

x1.victim.com ? TID=y answer TID=y Attacker RDNS ADNS for victim.com

slide-32
SLIDE 32

Kaminsky Vulnerability (cont.)

3/11/2014 PAM 2014 11

Attacker RDNS ADNS for victim.com www.victim.com ?

slide-33
SLIDE 33

Kaminsky Vulnerability (cont.)

3/11/2014 PAM 2014 11

Attacker RDNS ADNS for victim.com www.victim.com ?

slide-34
SLIDE 34

Kaminsky Vulnerability (cont.)

  • 65K possible transaction IDs
  • First attempt likely unsuccessful, so repeat with:
  • x2.victim.com
  • x3.victim.com
  • etc…
  • Since none of these names will be in the resolver’s cache, can retry

immediately

  • Eventually, the attacker will guess correctly

3/11/2014 PAM 2014 12

slide-35
SLIDE 35

Mitigating the Kaminsky Vulnerability

  • Add entropy to response beyond just a random transaction ID
  • Randomized ephemeral port
  • 0x20 encoding
  • Random capitalization of query string, i.e. X1.VicTIm.Com
  • ADNS echoes the capitalization back
  • Attacker must guess capitalization
  • 1 bit of entropy per letter in query string
  • DNSSEC and ingress filtering defeat the Kaminsky Attack
  • Slow progress means mitigation is needed

3/11/2014 PAM 2014 13

slide-36
SLIDE 36

Survey of Mitigations to Kaminsky

  • Send multiple DNS requests through each RDNS
  • Classify RDNS where 10 or more DNS requests arrive at our ADNS
  • Nearly all classified resolvers appear to use random transaction IDs
  • 16% of classified resolvers use static ephemeral ports!
  • 0x20 encoding rare
  • (lower bound)

3/11/2014 PAM 2014 14

Observation RDNS Number Percentage Total Classified 57K 100% Complex Transaction ID Sequence 57K 100% Variable Ephemeral Port 48K 84% 0x20 Encoding 195 0.3%

slide-37
SLIDE 37

Preplay Vulnerability

  • If RDNS are vulnerable, what about FDNS?
  • FDNS:
  • Residential locations
  • Most likely home wifi routers
  • Little attention paid to security
  • We found that FDNS have a vulnerablility that is much easier to

exploit than the Kaminsky vulnerability

3/11/2014 PAM 2014 15

slide-38
SLIDE 38

Attacker

Preplay Vulnerability (cont.)

3/11/2014 PAM 2014 16

www.victim.com ? www.victim.com ? www.victim.com = V RDNS FDNS

slide-39
SLIDE 39

Attacker

Preplay Vulnerability (cont.)

3/11/2014 PAM 2014 16

www.victim.com ? www.victim.com ? www.victim.com = A www.victim.com = V RDNS FDNS

slide-40
SLIDE 40

Attacker

Preplay Vulnerability (cont.)

3/11/2014 PAM 2014 16

www.victim.com ? www.victim.com ? www.victim.com = A www.victim.com = A www.victim.com = V www.victim.com = A RDNS FDNS

slide-41
SLIDE 41

Attacker

Preplay Vulnerability (cont.)

3/11/2014 PAM 2014 16

www.victim.com ? www.victim.com ? www.victim.com = V www.victim.com = A www.victim.com = A www.victim.com = V www.victim.com = A RDNS FDNS

slide-42
SLIDE 42
  • RDNS IP address, transaction ID, and port numbers are not validated!
  • 7-9% FDNS are vulnerable
  • 2-3 million out of the ~32 million open resolvers on the Internet

Attacker

Preplay Vulnerability (cont.)

3/11/2014 PAM 2014 16

www.victim.com ? www.victim.com ? www.victim.com = V www.victim.com = A www.victim.com = A www.victim.com = V www.victim.com = A RDNS FDNS

slide-43
SLIDE 43

Attacker

Implication: Indirect Attacks

  • 62% of RDNS are closed, yet still accessible through FDNS
  • FDNS are an avenue to detect and attack closed resolvers

3/11/2014 PAM 2014 17

x.com ? FDNS Closed RDNS

slide-44
SLIDE 44

Implication: Phantom DDoS Attacks

3/11/2014 PAM 2014 18

Attacker FDNS

V

slide-45
SLIDE 45

Implication: Phantom DDoS Attacks

3/11/2014 PAM 2014 18

large.record large.record Attacker FDNS

V

slide-46
SLIDE 46

Implication: Phantom DDoS Attacks

3/11/2014 PAM 2014 18

large.record ? from V large.record large.record Attacker FDNS

V

slide-47
SLIDE 47

Implication: Phantom DDoS Attacks

3/11/2014 PAM 2014 18

large.record ? from V large.record large.record large.record Attacker FDNS

V

slide-48
SLIDE 48
  • Advantages for an attacker:
  • Achieve maximum amplification
  • Do not need ADNS
  • Or even a registered DNS record

Implication: Phantom DDoS Attacks

3/11/2014 PAM 2014 18

large.record ? from V large.record large.record large.record Attacker FDNS

V

slide-49
SLIDE 49

Scanner RDNS FDNS Round-Trip Times

  • Attack only effective if there are users behind the FDNS
  • We test FDNS for use by looking for popular records in the FDNS’s

cache

  • If a popular record returned in ≪ RDNS RTT and ≈ FDNS RTT, then

FDNS is used

Context: Are Preplay Vulnerable FDNS Used?

3/11/2014 PAM 2014 19

slide-50
SLIDE 50

Context: Preplay Vulnerable FDNS Are Used!

  • 53% of FDNS have 1 or more

popular records in cache

  • (lower bound)
  • So, many Preplay vulnerable

FDNS are used

3/11/2014 PAM 2014 20

slide-51
SLIDE 51

Context: Effects of Sampling on RDNS

  • RDNS discovery dependent upon

FDNS that share the RDNS

  • Fraction of RDNS vulnerable to

Kaminsky continues to grow

  • Frequently shared RDNS less

vulnerable to Kaminsky

  • 3% of FDNS in front of Kaminsky

vulnerable RDNS

3/11/2014 PAM 2014 21

slide-52
SLIDE 52

Summary

  • Bailiwick violations are rare
  • Negative response rewriting occurs in 24% of FDNS
  • Search engine hijacking no longer prevalent
  • 16% of RDNS still have the Kaminsky vulnerability
  • But these are the less frequently used RDNS
  • 7-9% of FDNS (2-3M) can be trivially poisoned due to the Preplay

vulnerability

3/11/2014 PAM 2014 22

slide-53
SLIDE 53

Thank you! Questions?

Kyle Schomp – kgs7@case.edu

For access to our datasets: http://dns-scans.eecs.cwru.edu/

3/11/2014 PAM 2014 23

slide-54
SLIDE 54

Additional Slides

3/11/2014 PAM 2014 24

slide-55
SLIDE 55

Datasets

Scan Start Dur. (days) ODNS RDNS S1 2/29/12 17 1.09M 69.5K S2 3/1/13 11 40.5K 5.3K S3 7/9/13 12 2.31M 86.1K

3/11/2014 PAM 2014 25

slide-56
SLIDE 56

Residential Network Device Criteria

3/11/2014 PAM 2014 26

Criterion

  • No. ODNSes

% ODNSes RomPager 258K 24% Basic auth realm 265K 24% PBL Listed by SpamHaus 566K 51% PBL Listed by ISP 180K 17% Wrong port 529K 48% Total 849K 78%

slide-57
SLIDE 57

FDNS Cache Behavior

3/11/2014 PAM 2014 27

slide-58
SLIDE 58

RDNS Cache Behavior

3/11/2014 PAM 2014 28

slide-59
SLIDE 59

The Client-Side DNS Infrastructure

  • Origins are either end user devices or
  • ur measurement points
  • 95% of ODNS are FDNS
  • 78% of ODNS are likely residential

network devices

3/11/2014 PAM 2014 29

Structure of the client-side DNS infrastructure

  • bserved in our datasets.
slide-60
SLIDE 60

The Client-Side DNS Infrastructure

  • Origins are either end user devices or
  • ur measurement points
  • 95% of ODNS are FDNS
  • 78% of ODNS are likely residential

network devices

3/11/2014 PAM 2014 29

Structure of the client-side DNS infrastructure

  • bserved in our datasets.
slide-61
SLIDE 61

The Client-Side DNS Infrastructure

  • Origins are either end user devices or
  • ur measurement points
  • 95% of ODNS are FDNS
  • 78% of ODNS are likely residential

network devices

3/11/2014 PAM 2014 29

Structure of the client-side DNS infrastructure

  • bserved in our datasets.
slide-62
SLIDE 62

The Client-Side DNS Infrastructure

  • Origins are either end user devices or
  • ur measurement points
  • 95% of ODNS are FDNS
  • 78% of ODNS are likely residential

network devices

3/11/2014 PAM 2014 29

Structure of the client-side DNS infrastructure

  • bserved in our datasets.
slide-63
SLIDE 63

The Client-Side DNS Infrastructure

  • Origins are either end user devices or
  • ur measurement points
  • 95% of ODNS are FDNS
  • 78% of ODNS are likely residential

network devices

3/11/2014 PAM 2014 29

Structure of the client-side DNS infrastructure

  • bserved in our datasets.
slide-64
SLIDE 64

Presentation Organization

  • The Attacks
  • Implications of our findings
  • Indirect Attacks, Phantom Amplification Attacks
  • Context for our findings
  • Are FDNS Used, Effects of Sampling
  • Summary

3/11/2014 PAM 2014 30