1. A CSCE 548 presentation: Trusting Network Name Resolution
By:- Ajay Kumar Koduri
Source:- 24 deadly sins of software security programming flaws and how to fix them.
By; Michael Howard, David LeBlanc, John Viega

2. Contents Overview of the problem. Spotting the sin pattern.
Spotting the sin during code review.
Redemption steps.
References and other resources.
Conclusion.

3. OVERVIEW OF THE PROBLEM
What is Name Resolution?
DNS or WINS (Windows Internet Name Service) are used for name resolution.
Possible types of attacks.
The sin in detail

4. Overview of the problem
Source:-

5. Overview of the problem
Source:-

6. SPOTTING THE SIN pattern
This sin applies to any application that behaves as a client or server on a network.
Check if your browser is standard or not.
(i) Standard browsers provide most low-level security.
(ii) If it is not a standard browser SSL/TLS checks must be performed in the code.
SSL can be used to authenticate the client to the server.

7. Spotting the sin during code review
There’s no security checklist to check off because the defects are built into the architecture of the application. Unlike other sins, this sin of trusting name resolution is completely independent of the programming language you use. The infrastructure relied on is the problem.
Checking which network protocol is used for communications .
Avoiding UDP as a transport as it is more vulnerable than TCP.

8. TESTING TECHNIQUES TO FIND THE SIN
Build an evil client and evil server
Approach: create a way to proxy the information between the client and server.
Checking by attacker-controlled server.

9. REDEMPTION STEPS
Ensure the connections are running over SSL and the code is performing
all the appropriate PKI (Public Key Infrastructure).
Use IPSec (Internet Protocol Security).
Use public key cryptography.
Mapping DNS names to IP addresses using a “hosts file” (easiest way).

10. MORE redemption steps
Not to trust DNS information as its not reliable.
Specifying IP Sec for the systems on which your application will run on.

11. CONCLUSION
This problem if overlooked can harm the client severly. So, using the redemption steps mentioned to mitigate the possible vulnerabilities is a good practice especially if high security is desired.

12. REFERences and Other resources
Building Internet Firewalls, Second Edition by Elizabeth D. Zwicky, Simon Cooper, and
D. Brent Chapman (O’Reilly, 2000).
24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them. By;
Michael Howard, David LeBlanc, John Viega.
Threat Analysis of the Domain Name System (DNS) RFC 3833: archive.org/getrfc.php?rfc=3833
DNS Security Extensions:
DNSSEC Deployment Initiative: Oz
impact_of_rfc_on_dns_spoofing.pdf