Towards DNS

 Eventually, the [Link] system fell apart

 Not scalable, SRI couldn’t handle the load
 Hard to enforce uniqueness of names
 e.g MIT
 Massachusetts Institute of Technology?
 Melbourne Institute of Technology?
 Many machines had inaccurate copies of [Link]
 Thus, DNS was born
2 Outline

 DNS Basics
 DNS Security
 DNS and Censorship
DNS at a High-Level
3

 Domain Name System

 Distributed database
 No centralization
 Simple client/server architecture
 UDP port 53, some implementations also use TCP
 Why?
 Hierarchical namespace
 As opposed to original, flat namespace
 e.g. .com  [Link]  [Link]
Naming Hierarchy
4

Root

net edu com gov mil org uk fr etc.

 Top Level Domains (TLDs) are at the
neu mit top
 Maximum tree depth: 128
ccs ece husky  Each Domain Name is a subtree
 .edu  [Link]  [Link] 
[Link]
www login mail  Name collisions are avoided
 [Link] vs. [Link]
Hierarchical Administration
5

Verisign Root ICANN

net edu com gov mil org uk fr etc.

 Tree is divided into zones
neu mit  Each zone has an administrator
 Responsible for the part of the
ccs hierarchy
 Example:
 CCIS controls *.[Link]
www login mail  NEU controls *.[Link]
Server Hierarchy
6

 Functions of each DNS server:

 Authority over a portion of the hierarchy
 No need to store all DNS names
 Store all the records for hosts/domains in its zone
 May be replicated for robustness
 Know the addresses of the root servers
 Resolve queries for unknown names
 Root servers know about all TLDs
 The buck stops at the root servers
Root Name Servers
7

 Responsible for the Root Zone File

 Lists the TLDs and who controls them
 ~272KB in size

com.172800 IN NS [Link].
com.172800 IN NS [Link].
com.172800 IN NS [Link].

 Administered by ICANN
 13 root servers, labeled AM
 6 are anycasted, i.e. they are globally replicated
 Contacted when names cannot be resolved
 In practice, most systems cache this information
Map of the Roots
8
Local Name Servers
9 Where is
[Link]?

Northeastern

 Each ISP/company has a local, default name server

 Often configured via DHCP
 Hosts begin DNS queries by contacting the local name
server
 Frequently cache query results
Authoritative Name Servers
10

[Link] =
Where is [Link]
[Link]
[Link]?

Northeastern
Root edu neu

Authority Authority for

for ‘edu’ ‘[Link]’

 Stores the nameIP mapping for a given host

Basic Domain Name Resolution
11

 Every host knows a local DNS server

 Sends all queries to the local DNS server
 If the local DNS can answer the query, then you’re done
1. Local server is also the authoritative server for that name
2. Local server has cached the record for that name
 Otherwise, go down the hierarchy and search for the
authoritative name server
 Every local DNS server knows the root servers
 Use cache to skip steps if possible
 e.g. skip the root and go directly to .edu if the root file is cached
Recursive DNS Query
12
[Link]
Where is [Link]?

 Puts the burden of resolution

on the contacted name server
 How does asgard know who to
forward responses too?
[Link]
 Random IDs embedded in DNS [Link]
queries

com

Root
Iterated DNS query
13
[Link]
Where is [Link]?

 Contact server replies with

the name of the next
authority in the hierarchy
[Link] [Link]
 “I don’t know this name,
but this other server might”
 This is how DNS works
today com

Root
DNS Propagation
14

 How many of you have purchased a domain name?

 Did you notice that it took ~72 hours for your name to
become accessible?
 This delay is called DNS Propagation
[Link]

Root com

[Link] [Link]

 Why would this process fail for a new DNS name?

Caching vs. Freshness
15

 DNS Propagation delay is caused by caching

Where is That name does • Cached Root Zone File
[Link]?not exist. • Cached .com Zone File
• Cached .net Zone File
• Etc.

[Link]

Root
 Zone files may be cached com
for 1-72 hours

[Link] [Link]
DNS Resource Records
16

 DNS queries have two fields: name and type

 Resource record is the response to a query
 Four fields: (name, value, type, TTL)
 There may be multiple records returned for one query
 What do the name and value mean?
 Depends on the type of query and response
DNS Types
17

Type = A / AAAA

Query
 Name: [Link]
 Name = domain name Type: A
 Value = IP address
Name: [Link]

Resp.
 A is IPv4, AAAA is IPv6 Value: [Link]

 Type = NS
 Name = partial domain Query Name: [Link]
Type: NS
 Value = name of DNS server
for this domain Name: [Link]
Resp.

 “Go send your query to this Value: [Link]

other server”
DNS Types, Continued
18

Type = CNAME

Query
 Name: [Link]
 Name = hostname Type: CNAME
 Value = canonical hostname
Name: [Link]

Resp.
 Useful for aliasing Value: [Link]
 CDNs use this

Query
 Type = MX Name: [Link]
Type: MX
 Name = domain in email
address
Name: [Link]
Resp.

 Value = canonical name of Value: [Link]

mail server
Reverse Lookups
19

 What about the IPname mapping?

 Separate server hierarchy stores reverse mappings
 Rooted at [Link] and [Link]
 Additional DNS record type: PTR
 Name = IP address
 Value = domain name
Query
Name: [Link] Type:
 Not guaranteed to exist PTR
for all IPs
Name: [Link] Value:
Resp.

[Link]
DNS as Indirection Service
20

 DNS gives us very powerful capabilities

 Not only easier for humans to reference machines!

 Changing the IPs of machines becomes trivial

 e.g. you want to move your web server to a new host
 Just change the DNS record!
Aliasing and Load Balancing
21

 One machine can have many aliases

[Link] [Link]
[Link] [Link]
[Link] *.[Link]

 One domain can map to multiple machines

[Link]
Content Delivery Networks
22

DNS responses may

vary based on
geography, ISP, etc
23 Outline

 DNS Basics
 DNS Security
 DNS and Censorship
The Importance of DNS
24

 Without DNS…
 How could you get to any websites?
 You are your mailserver
 When you sign up for websites, you use your email address
 What if someone hijacks the DNS for your mail server?
 DNS is the root of trust for the web
 When a user types [Link], they expect to
be taken to their bank’s website
 What if the DNS record is compromised?
Denial Of Service
25

 Flood DNS servers with requests until they fail

 October 2002: massive DDoS against the root name
servers
 What was the effect?
 … users didn’t even notice
 Root zone file is cached almost everywhere
 More targeted attacks can be effective
 Local DNS server  cannot access DNS
 Authoritative server  cannot access domain
DNS Hijacking
26

 Infect their OS or browser with a virus/trojan

 e.g. Many trojans change entries in /etc/hosts
 *.[Link]  [Link]
 Man-in-the-middle

 Response Spoofing
 Eavesdrop on requests
 Race the servers response – Useful for censorship
 Where is
DNS Spoofing
[Link]? [Link]
27
How do you know that a given
nameIP mapping is correct?

Where is [Link]

[Link]?
[Link]
[Link]

[Link]

[Link]
 Where is
DNS Cache Poisoning
[Link]? [Link] =
Where is
28
[Link]? [Link]

[Link] [Link]

 Until the TTL expires, all queries for BofA to

[Link] =
[Link] will return poisoned result
 [Link]
Much worse than spoofing/man-in-the-middle
 Whole ISPs can be impacted!
How will the attacker get his entry into the cache? 2
ways
29

 1. Tell resolver that NS for victim is at adversary’s IP

 Issue query: [Link] IN A
 Attacker’s response:
 Answer: (no response)
 Authority Section: [Link]. 3600 IN NS [Link].
 Additional Section: [Link]. IN A w.x.y.z

Adversary says “authoritative server for my domain is

[Link] and oh by the way here is the IP for it
(adversary’s IP)
How will the attacker get his entry into the cache? 2
ways
30

 2. Redirect the NS record to the adversary’s domain

 Issue query: [Link] IN A
 Answer: (no response)
 Authority section:
 [Link]. 3600 IN NS [Link].
 Additional section:
 [Link]. IN A w.x.y.z

The attacker has inserted an unrelated piece of

information that will be cached by the server
(that [Link].’s ADNS is [Link].)
Solution: DNSSEC
31

 Cryptographically sign critical resource records

 Resolver can verify the cryptographic signature
 Two new resource types Creates a hierarchy of
 Type = DNSKEY trust within each zone
 Name = Zone domain name
Prevents hijacking
 Value = Public key for the zone and spoofing
 Type = RRSIG
 Name = (type, name) tuple, i.e. the query itself
 Value = Cryptographic signature of the query results

 Deployment
 On the roots since July 2010
 Verisign enabled it on .com and .net in January 2011
 Comcast is the first major ISP to support it (January 2012)
DNSSEC Hierarchy of Trust
32

Root Zone (ICANN)

.com (Verisign)

IP:
IP:[Link]
[Link]
Key: < >
Where is SIG:
SIG: 9na8x7040a3
x9fnskflkalk
[Link]? [Link]
[Link]
Does DNSSEC Solve all our
problems?
33

 No.
 DNS still vulnerable to reflection attacks + injected
responses
DNS Reflection
34

 Very big incident in 2012

 ([Link]
 65 Gbps DDoS
 Would need to compromise 65,000 machines each with 1 Mbps
uplink
 How was this attack possible?
 Use DNS reflection to amplify a Botnet attack.
 Key weak link: Open DNS resolvers will answer queries for
anyone [Link]
So how does this work?
35

 Remember: DNS is UDP

 No handshaking between endpoints
 I can send a DNS query with a forged IP address and the
response will go to that IP address
 Secret sauce: a small request that can elicit a large response
 E.g., query for zone files, or DNSSEC records (both large
record types).
 Botnet hosts spoof DNS queries with victim’s IP address
as source
 Resolver responds by sending massive volumes of data to the
victim
 DNS amplification illustrated
36

Src: Victim
Dst: Open Resolver
DNS …

Open Resolver Victim

Sometimes the DNS resolver network
Src:by
thinks it is under attack Victim
the victim!!
Dst: Open Resolver
Hosts infected by botnet
DNS …
Amplification not unique to DNS
37

 NTP is the latest protocol to be used in this way:

 [Link]
[Link]
 (Exploiting NTP Monlist command which returns a list
of 600 most recent hosts to connect to the NTP server)
38 Outline

 DNS Basics
 DNS Security
 DNS and Censorship
DNS and Censorship
• DNS is a popular protocol for targeting by Internet
censors

 A few things to keep in mind …

• No cryptographic integrity of DNS messages
• DNSSEC proposed but not widely implemented
• Caching of replies means leakage of bad DNS data can
persist
Blocking DNS Names
• Can the cens or pres s ure the regis trar?
Name blocked, forever
Blocking DNS Names
 Can the censor pressure the ISPs?
 Just force an entry in the recursive resolver to poison results
for a given domain
 Clients can trivially evade this using alternate DNS
services
 E.g., Google’s [Link]
 …but this does require client changes
 Also, ISPs must not block third party DNS queries for this
to work
 Initially used by ISPs in the UK to block the Pirate Bay
Types of false DNS responses
DNS RESPONSE A
DNS RESPONSE A
DNS RESPONSE
[Link]
A
[Link]
[Link]
3rd Party DNS Server
NXDOMAIN ([Link])

DNS QTYPE A
[Link]

DNS Server
([Link])

DNS RESPONSE A
Block page server [Link]
([Link]) (correct IP)
Home connection
([Link]) This diagram assumes ISP
DNS Server is complicit.
Blocking DNS names
• Option A: get ISP resolver on board
• (Previous slide)
• Option B: On-path packet injection
• Censor injects a DNS response that races the legitimate reply
• Can be mostly countered with DNS-hold-open:
• Don’t take the first answer but instead wait for up to a second
• Generally reliable when using an out of country recursive
resolve (e.g., [Link], censor packet should win the race)
• Can be completely countered by DNS-hold-open + DNSSEC
• Accept the first DNS reply which validates
Reading from Web …
 Hold-On: Protecting Against On-Path DNS Poisoning,
H. Duan, N. Weaver, Z. Zhao, M. Hu, J. Liang, J. Jiang, K. Li, and V. Paxson.
• Idea: Once you receive a DNS packet, wait for a
predefined “hold-on” period before accepting the result.
• DNSSEC is still vulnerable to these injected packets and
does not make hold-on unneccessary
• Censor can just inject a reply with an invalid signature:
client will reject (denial of service)
• Method: Use active measurements to determine the
expected TTL and RTT to the server.
Hold-on in action
Checking feasibility: RTT
Checking feasibility: ttl
Performance of Hold-on
Lesson: You don’t have to wait that long to get the legitimate reply
Much More to DNS
49

 Caching: when, where, how much, etc.

 Other uses for DNS (i.e. DNS hacks)
 Content Delivery Networks (CDNs)
 Different types of DNS load balancing
 Dynamic DNS (e.g. for mobile hosts)
 DNS and botnets
 Politics and growth of the DNS system
 Governance
 New TLDs (.xxx, .biz), eliminating TLDs altogether
 Copyright, arbitration, squatting, typo-squatting