WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks

2009 IEEE/IFIP International Conference on Dependable Systems & Networks Pub Date : 2009-09-29 DOI:10.1109/DSN.2009.5270363

R. Perdisci, M. Antonakakis, Xiapu Luo, Wenke Lee

{"title":"WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks","authors":"R. Perdisci, M. Antonakakis, Xiapu Luo, Wenke Lee","doi":"10.1109/DSN.2009.5270363","DOIUrl":null,"url":null,"abstract":"Recently, a new attack for poisoning the cache of Recursive DNS (RDNS) resolvers was discovered and revealed to the public. In response, major DNS vendors released a patch to their software. However, the released patch does not completely protect DNS servers from cache poisoning attacks in a number of practical scenarios. DNSSEC seems to offer a definitive solution to the vulnerabilities of the DNS protocol, but unfortunately DNSSEC has not yet been widely deployed. In this paper, we proposeWild-card SECure DNS (WSEC DNS), a novel solution to DNS cache poisoning attacks. WSEC DNS relies on existing properties of the DNS protocol and is based on wild-card domain names. We show that WSEC DNS is able to decrease the probability of success of cache poisoning attacks by several orders of magnitude. That is, with WSEC DNS in place, an attacker has to persistently run a cache poisoning attack for years, before having a non-negligible chance of success. Furthermore, WSEC DNS offers complete backward compatibility to DNS servers that may for any reason decide not to implement it, therefore allowing an incremental large-scale deployment. Contrary to DNSSEC, WSEC DNS is deployable immediately because it does not have the technical and political problems that have so far hampered a large-scale deployment of DNSSEC.","PeriodicalId":376982,"journal":{"name":"2009 IEEE/IFIP International Conference on Dependable Systems & Networks","volume":"27 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2009-09-29","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"59","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"2009 IEEE/IFIP International Conference on Dependable Systems & Networks","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/DSN.2009.5270363","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 59

Abstract

Recently, a new attack for poisoning the cache of Recursive DNS (RDNS) resolvers was discovered and revealed to the public. In response, major DNS vendors released a patch to their software. However, the released patch does not completely protect DNS servers from cache poisoning attacks in a number of practical scenarios. DNSSEC seems to offer a definitive solution to the vulnerabilities of the DNS protocol, but unfortunately DNSSEC has not yet been widely deployed. In this paper, we proposeWild-card SECure DNS (WSEC DNS), a novel solution to DNS cache poisoning attacks. WSEC DNS relies on existing properties of the DNS protocol and is based on wild-card domain names. We show that WSEC DNS is able to decrease the probability of success of cache poisoning attacks by several orders of magnitude. That is, with WSEC DNS in place, an attacker has to persistently run a cache poisoning attack for years, before having a non-negligible chance of success. Furthermore, WSEC DNS offers complete backward compatibility to DNS servers that may for any reason decide not to implement it, therefore allowing an incremental large-scale deployment. Contrary to DNSSEC, WSEC DNS is deployable immediately because it does not have the technical and political problems that have so far hampered a large-scale deployment of DNSSEC.

查看原文本刊更多论文

WSEC DNS:保护递归DNS解析器免受投毒攻击

最近，一种新的针对递归DNS (RDNS)解析器缓存投毒的攻击被发现并公之于众。作为回应，主要的DNS供应商发布了他们软件的补丁。然而，在许多实际场景中，发布的补丁并不能完全保护DNS服务器免受缓存中毒攻击。DNSSEC似乎为DNS协议的漏洞提供了一个明确的解决方案，但不幸的是，DNSSEC尚未得到广泛部署。本文提出了一种针对DNS缓存投毒攻击的新解决方案——通配符安全DNS (WSEC DNS)。WSEC DNS依赖于DNS协议的现有属性，并基于通配符域名。我们表明，WSEC DNS能够将缓存中毒攻击的成功概率降低几个数量级。也就是说，在WSEC DNS到位的情况下，攻击者必须持续运行缓存中毒攻击数年，才能获得不可忽视的成功机会。此外，WSEC DNS为可能出于任何原因决定不实现它的DNS服务器提供了完全的向后兼容性，因此允许增量大规模部署。与DNSSEC相反，WSEC DNS可以立即部署，因为它不存在迄今为止阻碍DNSSEC大规模部署的技术和政治问题。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

2009 IEEE/IFIP International Conference on Dependable Systems & Networks

自引率

0.00%

发文量