NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities · Recursive DNS Inefficiencies and...

transcript

NXNSAttack: Recursive DNS

Inefficiencies and VulnerabilitiesYehuda Afek Anat Bremler-Barr Lior Shafir

Tel-Aviv University Interdisciplinary Center Herzelia Tel-Aviv University

• DNS System - Overview

• NXNSAttack: New Vulnerability:

• Several variants

• Mitigation and measurements

• Responsible Disclosure

• Conclusions

Outline

• DNS System - Overview

• NXNSAttack: New Vulnerability:

• Several variants

• Mitigation and measurements

• Responsible Disclosure

• Conclusions

Outline

NXNSAttack Vulnerability in the Wild

Vendors

ServiceProviders

DNS DoSed Internet useless

DNS System

Amazon

NYTimesfacebook

My.Bank.com

Google.com

My web site

Internet

zoom.us’s

zoom us

Recursive Resolvers

Authoritative Servers

.edu .com .us .net

cs.ucla.edu

ns.ucla.edu

DNS System RFC 1034Paul Mockapetris

USC.edu

Distributed, Hierarchical,> 10 Million servers

NS.getty.edu

ns.ISI.edu

DNS System

Recursive Resolver

cs.ucla.edu

1 rqst3 pkts x 2

Empty cache

.edu .com .us .net

ns.ucla.edu

USC.edu NS.getty.edu

ns.ISI.edu

cs.ucla.edu

DNS system [RFC 1034, Mockapetris 1987]

Requirements

• High Availability, 24x7, Fault tolerant

• Quick response

• Low communication overhead

• Authenticate

High Availability 1

Recursive Resolver

.edu.edu .com .us .net

Empty cache

ns.ucla.edu

10USC.edu

ns.ISI.edu

NS.getty.edu

cs.ucla.edu ??

Recursive Resolver

High Availability 2

Empty cache

cs.ucla.edu ??

ns.ucla.edu

ns.ISI.edu

Referral Response

Recursive Resolver

High Availability 3

Empty cache

cs.ucla.edu ??

ns.ucla.edu

ns.ISI.edu

What is the NS IP address?

Recursive Resolver

.edu TLD

TLDscs.ucla.edu ??

A request cs.ucla.edu

ucla.edu NS ns1.ucla.netucla.edu NS ns2.ucla.netucla.edu NS ns3.ucla.netucla.edu NS ns4.ucla.netno glue records

‘A` request ns1.ucla.net‘A` request ns2.ucla.net‘A` request ns3.ucla.net‘A` request ns4.ucla.net

Empty cache

Referral Response&Glue Records

Which referred NS is the

Quickest ?

ns1.ucla.net

ns1.ucla.edu NS ns1.ucla.netns4.ucla.edu NS ns2.ucla.netns4.ucla.edu NS ns3.ucla.netns4.ucla.edu NS ns4.ucla.netns1.ucla.net A 208.87.1.81ns1.ucla.net A 208.87.1.82ns1.ucla.net A 193.4.10.1ns1.ucla.net A 208.76.1.81

ns4.ucla.net NS ns1.ucla.netns4.ucla.net NS ns2.ucla.netns4.ucla.net NS ns3.ucla.netns4.ucla.net NS ns4.ucla.netns1.ucla.net A 208.87.1.81ns2.ucla.net A 208.87.1.82ns3.ucla.net A 193.4.10.1ns4.ucla.net A 208.76.1.81

ns2.ucla.net

ns3.ucla.net ns4.ucla.net

Practice:1 rqst microsoft.com

54 (126) pkts !!

Theory: 1 rqst3 pkts x 2

NXNSAttack

Recursive Resolver

.attacker.com

NS.UCLA.edu

NS.ISI.edu

Ns.getty.eduUSC.e

xre.attacker.com ns1.fake1.netns2.fake8.netns3.fake3.net

ns.fake135.net

Packet Amplification factor𝟏𝟑𝟓∗𝟐∗𝟐∗𝟔

𝟐= 1620

IPv4 & IPv6

Send & Receive

TCP – O/H Attacker cost

Variant #1:on TLD

NXNSAttack

Recursive Resolver

.attacker.com

NS.UCLA.edu

NS.ISI.edu

Ns.getty.eduUSC.e

xre.attacker.com ns1.fake1.netns2.fake8.netns3.fake3.net

ns.fake135.net

Packet Amplification factor𝟏𝟑𝟓∗𝟐∗𝟐∗𝟔

𝟐= 1620

IPv4 & IPv6

Send & Receive

TCP – O/H Attacker cost

Variant #1:on TLD

Recursive Resolver

Ns.getty.eduUSC.e

xyz.attacker.com

NXNSAttack !! TLD focus (.com)

NS.UCLA.edu

.attacker.com

Other Variations

Recursive Resolver

NS.ISI.edu

Ns.getty.eduUSC.e

xyz.attacker.com

37X 4 = 148/2=74

NXNSAttack !! on SLD

19NO TCP – O/H

NS.UCLA.edu

.attacker.com(NS.ucla.edu)

Recursive Resolver

NS.ISI.edu

Ns.getty.eduUSC.e

xyz.attacker.com

37X 4 = 148/2=74

NXNSAttack !! on SLD

20NO TCP – O/H

NS.UCLA.edu

.attacker.com(NS.ucla.edu)

Recursive Resolver

Ns.getty.eduUSC.e

xyz.attacker.com

NXNSAttack !! SLD focus

NS.UCLA.edu21

.attacker.com

NS.ucla.edu

Recursive Resolver

Ns.getty.edu

xyz.attacker.com

NXNSAttack !! Resolver focus

NS.UCLA.edu22

.attacker.com

NXNSAttack !! 𝐅𝟐 on ROOT

Recursive Resolver

xyz.attacker.com

Packet Amplification factor= 3200 !! On root !!

.attacker.com TLD

Packets Processed = 74•135•2•2•6=239,760 !!!

74 x 135 x 2 = 19,980 RQSTs

Acquiring / controlling an Authoritative

• Option 1: $1 and 5 minutes, to acquire a new domain name

Dynamic association with any Authoritative

• Option 2: DNS hijacking attacks

Gain operators’ credentials to manipulate zone-files

Amplifications in the wild

Mitigation

26# Name Servers / referral resp.

• MaxFetch(k) – Resolve NS-names k at a time, not all at once

– Amortized on several queries

• MaxBreadth – bound # of NS-names per referral response

• Detect NX NS replies (NLnetLabs)

• DNSSEC – NSEC (Petr Špaček)

Mitigation

• MaxFetch(k) – Resolve NS-names k at a time, not all at once

– Amortized on several queries

• MaxBreadth – bound # of NS-names per referral response

• Detect NX NS replies (NLnetLabs)

• DNSSEC – NSEC (Petr Špaček)

• Going only downwards in the DNS hierarchy (draft rfc)

MaxFetch(1) on Normal Operation

Recursive Resolver

.edu TLD

..edu .net

TLDscs.ucla.edu

ns1.dns.ucla.edu

MaxFetch(1)

ns2.dns.ucla.eduns3.dns.ucla.edu

ns4.dns.ucla.edu

ns1.dns.ucla.edu

ns2.dns.ucla.edu

MaxFetch(1), Amplification down 743

MaxFetch(1) no effect on latency• No observed failures

• Latency slightly improved !!

Responsible Disclosure

February18

May 19

ConfirmedEmbargo

Patched & Updated

1 Expected RewardBug Bounty

Conclusions

• Mirai X 800 !!

• Worrisome, Fatal flaw

• Could there be another similar flaw?

• Formal/automatic verification methods

• Trade offs: Availability Vulnerability

Response time Vulnerability

• Re-design 32

Thank you

http://cyber-security-group.cs.tau.ac.il/

NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities · Recursive DNS Inefficiencies and...

Documents