Perils of transitive trust in the domain name system

Abstract

The Domain Name System, DNS, is based on nameserver delegations, which introduce complex and subtle dependencies between names and nameservers. In this paper, we present results from a large scale survey of DNS that shows that these dependencies lead to a highly insecure naming system. We report specifically on three aspects of DNS security: the properties of the DNS trusted computing base, the extent and impact of existing vulnerabilities in the DNS infrastructure, and the ease with which attacks against DNS can be launched. The survey shows that a typical name depends on 46 servers on average, whose compromise can lead to domain hijacks, and names belonging to some countries depend on a few hundred nameservers. An attacker exploiting well-documented vulnerabilities in DNS can hijack more than 30% of the names appearing in the Yahoo and DMOZ.org directories. And certain nameservers, especially in educational institutions, control as much as 10% of the namespace.

TrickleDNS: Bootstrapping DNS security using social trust

“…Unfortunately [19]), the resulting relationships form a more elaborate trust network, transitively [19]. (c) Finally, nameservers of a domain have implicit relationships with the nameservers of the parent domain, which are trusted by default.…”

“…This snapshot was generated from a study done at Cornell University [19] and contains 166, 771 distinct name servers that contribute towards resolution of 597, 196 distinct domains. Figure 5 shows the CDF of the number of attacks against the authoritative nameservers of the parent domain that the majority-consensus approach can tolerate.…”

“…To construct the DNS trust graph, we used the same DNS relationships dataset obtained from Cornell [19] we used previously. We represent the nameservers as vertices and undirected edges as the trust relationships between all authoritative nameservers of a domain.…”

Towards a Secure Rendezvous Network for Future Publish/Subscribe Architectures

“…Attackers were able to alter DNS messages or even hijack DNS sessions by taking advantage of the lack of cryptography as well as of the small set and non-randomized transaction identities. Even in 2005, after many years of DNS usage, it was found that reliance on poor transitive trust relations can lead, in many cases, to failures-as they occur in different administrative domains than the attacked DNS server [15]. Rendezvous networks should be designed with trust in mind, moreover as we learned from the DNS paradigm, no matter how well-designed a protocol is, its implementation may suffer from security vulnerabilities, therefore a reliable rendezvous network should be fault tolerant.…”

Resource allocation in decentralised computational systems: an evolutionary market-based approach

“…This brittleness may be mitigated against to a certain degree, with backup coordinator nodes, however even in these cases the wider system is reliant upon the existence and performance of a small number of key nodes. Failure at these key points in the network may well cripple wider functionality, at best [45]. These drawbacks lead to the need for a truly decentralised approach to the allocation of resources that does not rely on a central coordinator [23].…”