1. TODAY & TOMORROW DAY 2 - GROUP 5 PRESENTED BY: JAMES SPEIRS CHARLES HIGBY BRADY REDFEARN Domain Name System (DNS)

2. Overview Day 1 Review DNS Exploit Types DNS SEC Public Key Infrastructure (PKI) DNS SEC Implementation Early DNS Fixes DNS SEC Proposals Which Is Best?

3. Day 1 Review DNS Bailiwick Dan Kaminski DNS Poisoning SSL & HTTPS

4. DNS Exploit Types Cache poisoning o Dan Kaminiski o HD Moore  Metasploit  10 seconds Client flooding o No other DNS responses are received o Denial-of-Service (DoS) Dynamic update o Everything freely available - no query required Hosts file o Malware attacks

5. DNS SEC Pros: o Can distribute public keys  email o IPs are distributed securely o Reliable o Robust Cons: o Rework of DNS infrastructure (UDP)  10x larger packets  100x more resources o Easier to run DoS attack o Unbroken zone signing all the way to the root

6. Public Key Infrastructure (PKI) 1. I ask the Certificate Authority (CA) to issue a certificate in my name 2. The CA validates my identity, then issues me a certificate 3. I present a certificate containing my identity to the user 4. The user doesn't know me, so they ask the CA to verify my identity 5. The CA checks that my certificate is valid: unaltered, unexpired, legitimate 6. The CA tells the user my certificate is valid 7. User now trusts me

7. PKI Example

8. DNS SEC Implementation "Report on the ccNSO’s DNSSEC Survey 2009," http://ccnso.icann.org/surveys/dnssec-survey-report-2009.pdf

9. Early DNS Fixes Transaction ID randomization Source port randomization

10. Evgeniy Polyakov Cracked full-patched BIND 9 o In 10 hrs o With gigabit Ethernet o Trojan horse could do this within network

11. De-Bouncing Double queries Pros o Verified DNS queries o Easy to implement Cons o Not enough bandwidth o Servers too busy o Easy to run DoS

12. Abandon UDP Make all DNS traffic TCP 3-way handshake to start 2 for question/answer 2 to shutdown Pros: o No information limit o Can use PKI Cons: o 7x more bandwidth o Need more hardware o Bridge UDP to TCP packeting

13. 0x20 Case sensitivity Case is preserved in DNS query Pros: o Random case can be sent o Reply can be verified o Authoritative Name Servers need no update o No bandwidth increase o Easy to implement Cons: o Querying servers need update o Client update o Query servers need hardware

14. Domain Vouching Look-aside technology Pros: o Distributed load o One party maintains all DNS info Cons: o Bottleneck at voucher o Reliant on third-party service availability o DoS on third-party machine o URL redirection  example.com  example.voucher.com

15. U.S. Controls All Department of Homeland Security (DHS) controls DNS activity Pros: o Can we trust DHS? o One authority? o U.S. dominance of Internet Cons: o Politics  Any non-US government is opposed o Censorship o One authority o Trust

16. PGP Signing Model Proven example for PKI Pros: o Multiple non-governmental signers approve all keys  Peer approval  CA approval  Anyone approves o Create Root Key Set o Distribute Root Key Sets o Distributed load o No single point of failure Cons: o Someone has to approve your key o Some more hardware o Everyone has to do it

17. Which Is Best? Class Discussion

18. Summary Everything depends on DNS DNS SEC 9 yrs old Lots of proposals No perfect solution PGP model seems best right now Lots of work to do Without DNS SEC, we're in trouble

19. Questions

20. Vocabulary KSK - Key Signing Keys ZSK - Zone Signing Key RZM - Root Zone Maintainer RKO - Root Key Operator RZF - Root Zone File RKS - Root Key Set ZKS - Zone Key Set