Zone Poisoning: the How and Where of Non-Secure DNS Dynamic Updates
Total Page：16
File Type：pdf, Size：1020Kb
Zone Poisoning: The How and Where of Non-Secure DNS Dynamic Updates Maciej Korczynski´ Michał Król Michel van Eeten Delft University of Université de Technologie Delft University of Technology de Compiègne Technology The Netherlands France The Netherlands [email protected] [email protected] [email protected] ABSTRACT In this study, we explore an attack against the au- This paper illuminates the problem of non-secure DNS thoritative end of the path: the zone file of the authori- dynamic updates, which allow a miscreant to manipu- tative name server itself. We detail how the vulnerable- late DNS entries in the zone files of authoritative name by-design, non-secure DNS dynamic update protocol servers. We refer to this type of attack as to zone extension potentially allows anyone who can reach an poisoning. This paper presents the first measurement authoritative name server to update the content of its study of the vulnerability. We analyze a random sam- zone file. The attacker only needs to know the name of ple of 2.9 million domains and the Alexa top 1 mil- the zone and the name server for that zone. The vul- lion domains and find that at least 1,877 (0.065%) and nerability was indicated already in 1997 by Vixie et al. 587 (0.062%) of domains are vulnerable, respectively. in RFC 2136 [38], but its relevance in the current DNS Among the vulnerable domains are governments, health landscape has not been recognized nor studied. care providers and banks, demonstrating that the threat We refer to this type of attack as to zone poisoning. impacts important services. Via this study and subse- In the simplest version of an attack, a miscreant could quent notifications to affected parties, we aim to im- replace an existing A or MX resource record (RR) in a prove the security of the DNS ecosystem. zone file of an authoritative server and point the domain name to an IP address under control of an attacker. We already know that criminals are interested in hack- Keywords ing DNS records of legitimate domains from the practice Domain Name System; zone poisoning; dynamic up- of domain shadowing, where registrant credentials are dates; measurement; security compromised in order to create a large volume of subdo- mains of a legitimate domain. They are used for, among 1. INTRODUCTION other things, distributing malware exploit kits [13]. A more ambitious vector is hacking the registrars directly, The Domain Name System (DNS) provides a critical as illustrated by the attack of Syrian Electronic Army service for all Internet applications that depend on do- on Melbourne IT, the registrar for the New York Times main names. Over the years, a variety of threats have and Twitter [10]. In contrast to these attacks, zone emerged that undermine the trustworthy resolution of poisoning does not require compromising registrants or domain names into IP addresses. Two well-known at- registrars, but is as simple as sending a single RFC- tacks are cache poisoning [21] and malicious name res- compliant DNS dynamic update packet to a misconfig- olution services [23, 16]. What these attacks share in ured server. common is that they compromise the resolution path We present the first study to detail this vulnerabil- somewhere between the user and the authoritative name ity and measure its prevalence in the wild. Our main server for a domain. contributions are summarized as follows: Permission to make digital or hard copies of all or part of this work for personal • We analyze the root cause of non-secure dynamic up- or classroom use is granted without fee provided that copies are not made or dates and how they can be exploited. distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work • We measure which domains allow non-secure dynamic owned by others than ACM must be honored. Abstracting with credit is per- mitted. To copy otherwise, or republish, to post on servers or to redistribute to updates in a random sample of 1% from 286 million lists, requires prior specific permission and/or a fee. Request permissions from domains and find that 0.065% is vulnerable. Surpris- [email protected]. ingly, we find a similar rate (0.062%, meaning 587 IMC 2016, November 14-16, 2016, Santa Monica, CA, USA domains) for the Alexa top 1 million domains. c 2016 ACM. ISBN 978-1-4503-4526-2/16/11. $15.00 DOI: http://dx.doi.org/10.1145/2987443.2987477 • Alarmingly, we find a significant number of domains of national governments, universities, and businesses, server [38]. In RFC 2137, Donald Eastlake describes including nine domains belonging to banks in Europe, how to use the DNS Security Extensions (DNSSEC) [15] Middle East, and Asia, from the domain of a pri- to restrict dynamic updates to authorized entities based vate banking firm to a domain belonging to one of on cryptographic keys [14]. However, using the public the largest banks in the world. key mechanism is less efficient and harder to manage. • We find significant concentrations of the vulnerabil- Three years after the introduction of DNS dynamic up- ity: securing the zone files of just 10 providers would dates, Vixie et al. proposed an efficient, lightweight al- reduce the prevalence of the issue with 88.6% in the ternative to authenticate dynamic updates: Secret Key random sample. Transaction Authentication for DNS (TSIG), which is based on shared secret keys and message authentication • We observe suspicious domains among the vulnerable code (MAC) [34]. population, but find no direct evidence of ongoing at- tacks. 2.3 Implementations • We find that most vulnerable servers are running Win- We now analyze common implementations of DNS dows DNS, NLnetLabs NSD, and ISC BIND. dynamic updates, paying special attention to the de- fault protocol configurations. The objective of this paper is to strengthen the se- BIND: Berkeley Internet Name Domain (BIND) is open curity of DNS. We notified all operators of non-secure source and the most widely used DNS software on the servers discovered during our measurements. Internet [19]. Version 8, released in 1997, first included a dynamic DNS component [20, 37]. In BIND 8 and 9, 2. BACKGROUND dynamic updates are disabled by default. An adminis- The DNS protocol was initially designed to support trator can add allow-update in the zone configuration queries of a statically configured database. Most of the and specify the hosts that are allowed to update records. data in the system was updated manually and expected An address match list can include entire subnetworks to change only slowly [30]. However, with the intro- or the built-in argument any, that allows all hosts to duction of dynamic allocation of network addresses to make dynamic updates. Since BIND 8.2, released in hosts [18], a more dynamic update mechanism for DNS 1999, the address match list supports TSIG. The basic became essential. configuration is still supported, however. Since BIND 9.1, slave servers are allowed to forward dynamic up- 2.1 Dynamic Updates in DNS dates to a master server (RFC 2136 [9]). These can DNS dynamic update specifications have been intro- use address match lists similar to those of the master, duced by Vixie et al. in RFC 2136 [38] in 1997. Follow- meaning that non-secure configurations provide an ad- ing this specification, one can add or delete any type of ditional path for a miscreant, as updates forwarded by RR, such as A, AAAA, CNAME, or NS. The proposed UP- the slave will be accepted by the master, regardless of DATE message complies with the standard DNS message the original requestor. format (cf. RFC 1035 [31]). Microsoft DNS: Windows 2000 is the first operating When a primary master server that supports dynamic system developed by Microsoft that supported DNS dy- updates receives an update request, it verifies: i) if namic updates [28]. The server can be configured either all prerequisites defined by the requestor are met (e.g. as standard primary or as Microsoft's Active Directory{ check whether a specific record does or does not ex- integrated zone [26]. Windows 2000 and its successors, ist) and ii) whether restrictions are set regarding which i.e. Windows Server 2003 [25], 2008 [29], and 2012 hosts are allowed to make updates and, if so, whether [27], all support secure dynamic updates. They im- those restrictions are met. If no restrictions are defined, plement an extended TSIG algorithm (RFC 3645 [24]). anyone who knows the name of the zone and the name When an administrator creates an Active Directory{ server for that zone is capable of updating its content. integrated zone, by default the server allows only se- This constitutes a serious technological vulnerability in- cure updates via extended TSIG. However, the server dicated by Vixie et al. in RFC 2136 [38]. If the request can also be configured for no or non-secure dynamic is sent to an authoritative slave server, it is expected updates. More importantly, the secure update func- that it will be forwarded towards the primary server tionality is not available for standard primary zones. In that is able to modify the zone file. any primary zone configured for DNS dynamic updates, anyone can modify zones. 2.2 Secure DNS Dynamic Updates Other Implementations: As indicated in RFC 2137 Vixie et al. strongly recommended the use of security [14], any zone file allowing dynamic updates is less se- measures such as those described in RFC 2137 [14] (su- cure than the one configured statically. Some of the perseded by RFC 3007 [39]).