Unintended Conseqences Obfuscated Attacks on TLDs Eberhard W Lisse - - PowerPoint PPT Presentation

▶

Nov 20, 2022 12 likes •202 views

Unintended Conseqences Obfuscated Attacks on TLDs Eberhard W Lisse & Alejandra Reynoso Namibian Network Information Center & Universidad del Valle de Guatemala 2017-06-26 Lisse & Reynoso (Johannesburg) Unintended Conseqences

SLIDE 1

Unintended Conseqences

Obfuscated Attacks on TLDs Eberhard W Lisse & Alejandra Reynoso

Namibian Network Information Center & Universidad del Valle de Guatemala

2017-06-26

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 1 / 15

SLIDE 2

na-nic.com.NA

Infrastructure Domain

2017-06-03: Email Received 3 of 4 Name Servers lame

(free) Service Provider

Possibility of Man in the Middle Atack DNSSEC not considered .NA was not compromised

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 2 / 15

SLIDE 3

(Why) Is This a Problem?

Man in the Middle

.NA ccTLD Admin and Technical Contacts

dns-admin@na-nic.com.NA dns-tech@na-nic.com.NA

IANA Root Zone Management

Requests confirmation by email from AC and TC Access to RZM

Web Interface Email Template

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 3 / 15

SLIDE 4

(Why) Is This a Problem?

Man in the Middle

Theoretical Scenario

Register with Service Provider

re-list na-nic.com.NA different Master propagation to the 3 Name Servers 3 of 4 MX hosts under control

Atempt modification of .NA

RZM (Email Template)

Would not Have Worked

na-nic.com.NA is DNSSEC signed IANA validates DNSSEC

Credible Threat

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 4 / 15

SLIDE 5

Mitigation

What Did We Do?

Fixed within minutes

removed lame delegations added 2 new servers (with TSIG)

Propagated within the hour

Register Portal

Reviewed all Infrastructure Zones

ZoneMaster Fixed all Warnings (no Errors found)

Contacted IANA

moved Tech Contact email out of Bailiwick dns-admin@na-nic.COM

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 5 / 15

SLIDE 6

What’s (in) a MNAME?

Show of Hands

Who is a TLD Manager?

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 6 / 15

SLIDE 7

What’s (in) a MNAME?

Show of Hands

Who is a TLD Manager? Who knows what the MNAME is?

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 6 / 15

SLIDE 8

What’s (in) a MNAME?

Show of Hands

Who is a TLD Manager? Who knows what the MNAME is? Who knows the requirements?

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 6 / 15

SLIDE 9

What’s (in) a MNAME?

Show of Hands

Who is a TLD Manager? Who knows what the MNAME is? Who knows the requirements?

RFC 1035 RFC 2181 RFC 2136

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 6 / 15

SLIDE 10

What’s (in) a MNAME?

Show of Hands

Who is a TLD Manager? Who knows what the MNAME is? Who knows the requirements?

RFC 1035 RFC 2181 RFC 2136

Who has recently checked?

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 6 / 15

SLIDE 11

What’s (in) a MNAME?

SOA 1dom.TLD

@ IN SOA MNAME. 1 dom . TLD . E . 1 dom . TLD . ( 2017061101 ; s e r i a l YYYYMMDDnn 86400 ; r e f r e s h (24 hours ) 7200 ; r e t r y (2 hours ) 360000 ; e x p i r e (1000 hours ) 3600 ; neg r e s u l t t t l (1 hour ) )

This is an example only...

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 7 / 15

SLIDE 12

What’s (in) a MNAME?

1dom.TLD Zone

@ IN SOA MNAME. 1 dom . TLD . E . 1 dom . TLD . (2017061101 86400 7200 360000 3600) IN NS NS . 2 dom . TLD . ; Secondary IN NS NS . 3 dom . TLD . ; Secondary IN NS MNAME. 1 dom . TLD . ;MNAME = PRIMARY MNAME IN A 1 2 7 . 0 . 0 . 1 ; Glue

This is an example only...

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 8 / 15

SLIDE 13

Possible MNAME Failures

And Possible Conseqences

MNAME does not have IP Address (glue)

Some DNS Traffic may get lost

MNAME’s Domain Name does not exist

As above Domain Name can be registered Man-In-the-Middle Atack becomes possible

MNAME can get (false) IP Address (Lost) DNS Traffic can be redirected

DNSSEC will protect

If Resolvers validate

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 9 / 15

SLIDE 14

Series of Unfortunate Events

Dynamic Update Errors

June 2016: Migration of .GT’s services 2017-01-31 Email received MNAME didn’t resolve

MNAME’s domain not registered

Possibility of Active Directory Vulnerability

Dynamic Update

.GT was not compromised

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 10 / 15

SLIDE 15

A Short Diversion

Windows Active Directory and Dynamic Update

AD Domain Services

Manages a number of services

Dynamic Update

Takes care of changing IP Addresses

DHCP

Uses MNAME to find (internal) Primary Updates A Record(s) on (internal) Primary

Internal traffic should remain internal

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 11 / 15

SLIDE 16

(Why) Is This a Problem?

Incredibly common

(Subtle) Misconfigurations can cause Leaks

Name Collision

DNS queries reach External Name Servers External MNAME is returned If external MNAME is registrable

DNS UPDATE can be captured/exploited

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 12 / 15

SLIDE 17

Mitigation

Within the Hour

Issue was rectified immediately MNAME was changed

Within a registered domain

MNAME does not resolve

To avoid receiving DNS UPDATE traffic

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 13 / 15

SLIDE 18

What Needs To be Done?

Prevention and/or Cure

RTFM

Again and again...

Diversify

Infrastructure

Manual Review of all Infrastructure Zones

Inefficient

Tool Supported Review

htps://www.zonemaster.net

We are unaware of fully automated tools

htps://github.com/dotse/zonemaster

DNSSEC

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 14 / 15

SLIDE 19

Qestions?

Now or Never

Thank you very much!

Lisse & Reynoso (Johannesburg) Unintended Conseqences 2017-06-17 15 / 15