Security of Alerting Authorities in the WWW: Measuring Namespaces, DNSSEC, and Web PKI

Abstract

During disasters, crisis, and emergencies the public relies on online services provided by official authorities to receive timely alerts, trustworthy information, and access to relief programs. It is therefore crucial for the authorities to reduce risks when accessing their online services. This includes catering to secure identification of service, secure resolution of name to network service, and content security and privacy as a minimum base for trustworthy communication.In this paper, we take a first look at Alerting Authorities (AA) in the US and investigate security measures related to trustworthy and secure communication. We study the domain namespace structure, DNSSEC penetration, and web certificates. We introduce an integrative threat model to better understand whether and how the online presence and services of AAs are harmed. As an illustrative example, we investigate 1,388 Alerting Authorities. We observe partial heightened security relative to the global Internet trends, yet find cause for concern as about 78% of service providers fail to deploy measures of trustworthy service provision. Our analysis shows two major shortcomings. First, how the DNS ecosystem is leveraged: about 50% of organizations do not own their dedicated domain names and are dependent on others, 55% opt for unrestricted-use namespaces, which simplifies phishing, and less than 4% of unique AA domain names are secured by DNSSEC, which can lead to DNS poisoning and possibly to certificate misissuance. Second, how Web PKI certificates are utilized: 15% of all hosts provide none or invalid certificates, thus cannot cater to confidentiality and data integrity, 64% of the hosts provide domain validation certification that lack any identity information, and shared certificates have gained on popularity, which leads to fate-sharing and can be a cause for instability. CCS CONCEPTS• Security and privacy → Web application security; Domainspecific security and privacy architectures.This paper is published under the Creative Commons Attribution 4.0 International (CC-BY 4.0) license. Authors reserve their rights to disseminate the work on their personal and corporate Web sites with the appropriate attribution.

The far side of DNS amplification

“…DNSSEC is a DNS extension that enables verification of DNS content but at the same time significantly increases the potential for amplification due to larger response sizes [6,61]. Consequently, benign .gov names, which are subject to a DNSSEC mandate [58], started being misused in amplification attacks [59].…”

An intelligent proactive defense against the client‐side DNS cache poisoning attack via self‐checking deep reinforcement learning

“…DNSSEC is a security authentication mechanism recommended by Internet Engineering Task Force 32 . However, Fotouhi Tehrani et al 10 found that less than 4% of unique alerting authority (AA) domain names is secured by DNSSEC due to the lack of security awareness and the complexity of deployment. Müller et al 16 analyzed the DNSSEC key management.…”

“…Therefore, client‐side caching requirements continue to rise. Meanwhile, the client‐side cache insulates users from transient DNS server downtime 9 and reduces network traffic load 10 …”