1. DUKE UNIVERSITY WWW.OIT.DUKE.EDU DNSSEC 101 Kevin Miller

2. DUKE UNIVERSITY WWW.OIT.DUKE.EDU DNS Underpins Everything Email Web Enterprise Systems VoIP IM CMS

3. DUKE UNIVERSITY WWW.OIT.DUKE.EDU DNS Underpins Everything Email Web Enterprise Systems VoIP IM CMS Inbound Email Volume Received Email Spam, virus filtering using DNS Received Email Spam, virus filtering using DNS 10+ DNS Queries Per Message 10+ DNS Queries Per Message

4. DUKE UNIVERSITY WWW.OIT.DUKE.EDU Risks from DNS Attacks Impersonate your web site Redirect your phone calls Man-in-the-middle (password theft) Reroute or block your email Disrupt your network, application services Attack vectors for malware (data theft) Denial of service Diagram source: Internet Storm Center

5. DUKE UNIVERSITY WWW.OIT.DUKE.EDU DNS Attack: Cache Poisoning Where is website.com? Answer: 67.11.23.9 Also, www.bank.com – 12.1.2.3 Answer: 67.11.23.9 Also, www.bank.com – 12.1.2.3

6. DUKE UNIVERSITY WWW.OIT.DUKE.EDU DNS Attack: Forgery Where is educause.edu? Answer: 198.59.61.65 Answer: 12.1.2.3

7. DUKE UNIVERSITY WWW.OIT.DUKE.EDU DNS Attack: Indirection Where is educause.edu? Answer: 12.1.2.3

8. DUKE UNIVERSITY WWW.OIT.DUKE.EDU DNS Attack: Amplification 60 byte request 4000 byte response 4000 byte response

9. DUKE UNIVERSITY WWW.OIT.DUKE.EDU Software Defects Buffer overflow Other vectors Buffer overflow Other vectors

10. DUKE UNIVERSITY WWW.OIT.DUKE.EDU Risk Reduction To Date Improving weaknesses in DNS software – Patching software defects – Limiting cache poisoning opportunities Improve operational best practices – Restrict access to DNS recursers – Install anti-IP spoofing filters Improve host security – Anti-virus, anti-malware defenses Photo source: BCP38

11. DUKE UNIVERSITY WWW.OIT.DUKE.EDU DNSSEC Cryptographically sign DNS records – Also the absence of records Maintains DNS architecture – Hierarchical, distributed signatures Significant risk reduction, if used widely – Protects you (www.school.edu) – Protects your users (www.bank.com)www.bank.com

12. DUKE UNIVERSITY WWW.OIT.DUKE.EDU What Can Be Done Now? Discover local implications – How do you manage DNS? What tools are used? – What impact would DNSSEC have? – Do your vendors support it? – Can you servers handle DNSSEC overhead? Begin building expertise, experience – Sign a test zone – Deploy a test DNSSEC recurser Deployment – Sign your zones – Utilize DNSSEC-enabled recurser with DLV

13. DUKE UNIVERSITY WWW.OIT.DUKE.EDU Additional Resources http://www.dnssec.net http://www.bind9.net http://www.dnsreport.com http://www.dnssec-deployment.org/ http://www.uoregon.edu/~joe/port53wars/port 53wars.pdf http://www.uoregon.edu/~joe/port53wars/port 53wars.pdf http://www.nanog.org/mtg-0606/damas.html