Touring DNS Open Houses for Trends and Configurations

Kalafut, Andrew J.; Shue, Craig A.; Gupta, Manika

doi:10.1109/tnet.2011.2130537

Cited by 10 publications

(7 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We return a single response, a CNAME, but rather than provide a host name in the response, we incorrectly provided an IP address. Such mistakes were found in a number of zones in previous work [Kalafut et al 2011]. …”

Section: Interactive Dns Resolver Profilingmentioning

confidence: 56%

See 1 more Smart Citation

Resolvers Revealed

Shue

Kalafut

2013

ACM Trans. Internet Technol.

Self Cite

View full text Add to dashboard Cite

The Domain Name System (DNS) allows clients to use resolvers, sometimes called caches, to query a set of authoritative servers to translate host names into IP addresses. Prior work has proposed using the interaction between these DNS resolvers and the authoritative servers as an access control mechanism. However, while prior work has examined the DNS from many angles, the resolver component has received little scrutiny. Essential factors for using a resolver in an access control system, such as whether a resolver is part of an ISP's infrastructure or running on an end-user's system, have not been examined. In this study, we examine DNS resolver behavior and usage, from query patterns and reactions to nonstandard responses to passive association techniques to pair resolvers with their client hosts. In doing so, we discover evidence of security protocol support, misconfigured resolvers, techniques to fingerprint resolvers, and features for detecting automated clients. These measurements can influence the implementation and design of these resolvers and DNS-based access control systems.

show abstract

Section: Interactive Dns Resolver Profilingmentioning

confidence: 56%

“…Our own prior work related to DNS [Kalafut et al 2011] investigated the contents of DNS zones and found some errors in their configurations. Prior work by Pappas et al [2009] investigated three specific configuration errors with potential impacts on DNS availability in greater detail.…”

Section: Related Workmentioning

confidence: 99%

Resolvers Revealed

Shue

Kalafut

2013

ACM Trans. Internet Technol.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Kalafut [4], attempted to transfer the zones listed in the .com and .net TLDs. They investigated zone transfer, zone diversity, deployment of new technologies and other configuration issues by downloading 6.6 % of zone file for second level domain names listed in .com and .net top-level domains.…”

Section: Related Workmentioning

confidence: 99%

Search Engine Based Investigation on Misconfiguration of Zone Transfer

Yoshioka

Matsumoto

2013

2013 Eighth Asia Joint Conference on Information Security

View full text Add to dashboard Cite

This study proposes how to investigate the existence of misconfigurations of zone transfer in any level of domain name system hierarchy using search engine based approach without the need to look at the zone file. The analysis has been conducted on 1,284 authoritative name servers of 314 top-level domains and 46,416 authoritative name servers of second level domain of 249 country code top-level domains. In case of top-level domains investigation, 84 name servers authoritative to answer for 53 top-level domains are misconfigured and allow zone transfer to us. In case of second level domains investigation, 5,394 authoritative name servers authoritative to answer for 6,234 second-level domains allow zone transfer. In particular, we found a serious misconfiguration case where the misconfigured DNS server was authoritative for not only its TLD but also SLD and lower level, exposing 83 % the DNS related information of the country to the public.

show abstract

“…One example is DNSSEC which helps to provide origin authentication and integrity assurances for the DNS messages [4]. A problem plaguing DNSSEC, and other Internet security features alike, is that it has a low adoption rate [8]. We attempt to overcome this by providing a simple, yet robust, system.…”

Section: Introductionmentioning

confidence: 99%

Using the Domain Name System to Thwart Automated Client-Based Attacks

Taylor¹,

Shue

2011

View full text Add to dashboard Cite

On the Internet, attackers can compromise systems owned by other people and then use these systems to launch attacks automatically. When attacks such as phishing or SQL injections are successful, they can have negative consequences including server downtime and the loss of sensitive information. Current methods to prevent such attacks are limited in that they are application-specific, or fail to block attackers. Phishing attempts can be stopped with email filters, but if the attacker manages to successfully bypass these filters, then the user must determine if the email is legitimate or not. Unfortunately, they often are unable to do so. Since attackers have a low success rate, they attempt to compensate for it in volume. In order to have this high throughput, attackers take shortcuts and break protocols. We use this knowledge to address these issues by implementing a system that can detect malicious activity and use it to block attacks. If the client fails to follow proper procedure, they can be classified as an attacker. Once an attacker has been discovered, they are isolated and monitored. This can be accomplished using existing software in Ubuntu Linux applications, along with our custom wrapper application. After running the system and seeing its performance on three popular Web browsers Chromium, Firefox and Internet Explorer as well as two popular email clients Thunderbird and Evolution, we found that not only is this system conceivable, it is effective and has low overhead.

show abstract

Touring DNS Open Houses for Trends and Configurations

Cited by 10 publications

References 25 publications

Resolvers Revealed

Resolvers Revealed

Search Engine Based Investigation on Misconfiguration of Zone Transfer

Using the Domain Name System to Thwart Automated Client-Based Attacks

Contact Info

Product

Resources

About