Perils of Transitive Trust in the Domain Name System

1. Venugopalan Ramasubramanian Emin Gün Sirer Cornell University Perils of Transitive Trust in the Domain Name System

2. Venugopalan Ramasubramanian Emin Gün Sirer Cornell University How to 0wn the Internet in Your Spare Time? Part 2

3. Introduction • DNS is critical to the Internet • DNS architecture is based on delegations • control for names is delegated to name servers designated by the name owner • delegations facilitate high scalability and decentralized administration • what about security?

4. zoneedit.com • com • gtld-servers.net • nstld.com • net Dependencies for www.fbi.gov root www.fbi.gov gov • gov.zoneedit.com • zoneedit.com fbi.gov dns[,2].sprintip.com ns[3,4,5,6].vericenter.com sprintip.com • sprintlink.net • telemail.net vericenter.com

5. Subtle Dependencies in DNS • www.fbi.gov • 86 servers, 17 domains • www.cs.cornell.edu • cs.rochester.edu cs.wisc.edu  itd.umich.edu • 48 nameservers, 20 domains • DNS dependencies are subtle and complex • are administrators aware of what they depend on? • increases risk of domain hijacks

6. fbi.gov sprintip.com dns[,2].sprintip.com ns[3,4,5,6].vericenter.com ns[1,2,3]-auth.sprintlink.net reston-ns[1,3].telemail.net reston-ns[2].telemail.net Servers with Security Loopholes www.fbi.gov www.cs.cornell.edu  [slate,cayuga].cs.rochester.edu source: internet systems consortium (www.isc.org)

7. Survey Goals • Which domain names have large dependencies and entail high risk? • Which domains are affected by servers with known security holes and can be easily taken over? • Which servers control the largest portion of the namespace and are thus likely to be attacked?

8. Survey Methodology • 593160 domain names (Yahoo and Dmoz.org) • 166771 name servers • 535036 domains, 196 top-level-domain

9. All Top 500 Mean 46 68 Max 604 342 Median 26 22 Most Vulnerable Names Number of Dependencies

10. Most Vulnerable Names

11. Vulnerability to Security Flaws • survey of BIND version numbers • 17% of servers have known loopholes [ISC] • 45% of names are not totally safe • security through obscurity! • more than 40% of servers hide version numbers • 19/46 reports for cs.cornell.edu and 18/86 for fbi.gov

12. Vulnerability

13. Vulnerability to Security Flaws

14. Critical Assets

15. Most Valuable Nameservers Top 5 Domains arizona.edu ucla.edu uoregon.edu nyu.edu berkeley.edu

16. Conclusions • Domain names have subtle dependencies • name-based delegations • High risk of domain hijacks • well-known software loopholes • leading to more effective phishing attacks http://www.cs.cornell.edu/people/egs/beehive/codons.php

18. DNS-SEC • Security Standard for DNS based on public-key cryptography and digitally signed certificates • Not widely used currently • security at delegation points • authenticated denials • islands of security • Does not eliminate name-based delegations

19. DNS Bottlenecks

20. Safe Bottlenecks

21. Safety

22. Dependencies

23. Critical Assets 2

24. fbi.gov dns[,2].sprintip.com ns[3,4,5,6].vericenter.com sprintip.com ns[1,2,3]-auth.sprintlink.net reston-ns[1,2,3].telemail.net vericenter.com ns[1-6].vericenter.com Dependencies for www.fbi.gov gov • gov.zoneedit.com • zoneedit.com www.fbi.gov fbi.edgesuite.net a33.g.akamai.net zoneedit.com • com • gtld-servers.net • nstld.com • net edgesuite.net • akam.net g.akamai.net • akamai.net • akamaitech.net