1 / 13

DNSSEC

DNSSEC. CZ.NIC Pavel Tůma pavel.tuma@nic,cz 7. 5. 2009. What's wrong with DNS?. DNS protocol is 30 years old 1983 RFC, 1984 first implementation DNS is vulnerable to spoofing! Serious effects of abuse Phishing / pharming Information spoofing Eavesdropping Known …

allan
Download Presentation

DNSSEC

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. DNSSEC CZ.NIC Pavel Tůma pavel.tuma@nic,cz 7. 5. 2009 1

  2. 2 What's wrong with DNS? DNS protocol is 30 years old 1983 RFC, 1984 first implementation DNS is vulnerable to spoofing! Serious effects of abuse Phishing / pharming Information spoofing Eavesdropping Known … … but thought too complex and time consuming

  3. 3 Attack on DNS DNS information is considered trustworthy if response matches the query From: 1.2.3.4, port 20444 To: 5.5.5.5, port 53 My ID: 3058 Query: www.nic.cz www.nic.cz? 217.31.205.50 From: 5.5.5.5, port 53 To: 1.2.3.4, port 20444 Your ID: 3058 Query:www.nic.cz Answer: 217.31.205.50 88.88.88.88 Attack vector: deliver spoofed answer before the correct one arrives !

  4. 4 Attack on DNS Security measures: Port + Transaction ID DNS vulnerability case (Kaminski, August 2008) Port and Transaction ID predictability Time-to-live (TTL) irrelevant (querying random domain names) Compromised within seconds! Solution: full randomization (patches for all implementations) Servers patched ... … but all of them are still vulnerable!

  5. 5 Attack on DNS Brute force attack Theoretically 4.2 millions of Port and TrID combinations Average DNS message size is 120 bytes 1.1 million of combinations per second via 1 Gbps Querying random domains … Matter of time Lab testing 3 nodes over 1 Gbps LAN Common server grade hardware Compromised between 1:01 and 10:40!

  6. 6 Attack on DNS Attacking domain www.bank.cz at ABC ISP ... Spoofed authoritative DNS server for bank.cz Attacker - server ABC network Spoofed NS delegation Attacker - client www.bank.cz Spoofed IP address hjggf3.bank.cz alm2kj.bank.cz Does not exist Recursive DNS server o6xym7.bank.cz hjggf3.bank.cz NS bank.cz WiFi Correct authoritative DNS server for bank.cz Global DNS

  7. 7 DNSSEC Asymmetric cryptography within DNS DNS data digitally signed by private key DNS server contains Data itself Digital signature Public key Chain of trust – like with SSL Public key hash stored within superior authority Superior authority = Lower level domain somedomain.cz -> .cz

  8. 8 How DNSSEC works Root zone: DS n550f30618be204e SIG 31088aa325d9c403 Root keys: xd253c5f92441741 (Private) y46ea4256ad4b6a5 (Public) 199.7.83.42 = Local DNS .cz zone: DS be271f81f8771fc7 SIG d2a5e5bde52361e5 .cz keys: m61ac25e5febf351 (Private) n550f30618be204e (Public) Cache + Resolver a.ns.nic.cz Root: 199.7.83.42 = www.lidovky.cz is 194.79.52.194, signature is 8beaa99f59e5e7cc and public key is a69adbcdf38c323e .lidovky.cz zone: A 217.31.201.43 SIG 8beaa99f59e5e7cc lidovky..cz keys: be271f81f8771fc7 (Private) a69adbcdf38c323e (Public) ns.mafra.cz

  9. 9 .CZ implementation Only 8 DNSSEC enabled TLDs FRED free registry software (fred.nic.cz) EPP (extended) over TCP/SSL interface Zone generation every 30 minutes DNSSEC implementation goals Support sharing between domains Support multiple keys for easy key exchange Free registration (feature not service)

  10. 10 .CZ implementation Extended EPP with new object – KeySet DNSKEY instead DS (obsolete now) Allow re-use with many domains Less “key management voodoo” for end user NS NS SET Tech-c Domain Reg / Admin-c DNSSEC Key SET Tech-c

  11. 11 .CZ implementation Zone signing using Bind native tools – processed in SW HSM (various vendors) testing failed Low level of support & bugs BIND development version Working on CUDA acceleration Huge increase in zone size, from 40MB to 180MB Caused problems Bandwidth – 19 secondary locations Memory Solved with reusing signatures – based on ldns tools

  12. 12 Stats 759 domains 9 registrars (virtually all) support DNSSEC 87% of domain market 4 registrars have more than 10 domains

  13. 13 Questions?Thank you DNSSEC Pavel Tuma pavel.tuma@nic.cz http://www.nic.cz

More Related