Upload File

living on the edge: (re)focus dns efforts on the end-points · another possibility: dns over tls...

  • Home
  • Documents
  • Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net
25
http://www.nlnetlabs.nl/ Living on the Edge: (Re)focus DNS Efforts on the End-Points Benno Overeinder NLnet Labs RIPE 75, Dubai, UAE

Upload: others

Post on 24-Jul-2020

1 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

LivingontheEdge:(Re)focusDNSEffortsontheEnd-Points

BennoOvereinderNLnet Labs

RIPE75,Dubai,UAE

Page 2: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

ComplexityatCore-Middle-Edge

recursiveresolver

Authoritative.

Authoritativenet

Authoritativeripe

application

stub

OS

simple complex

moderate

e2e-nesssimple

e2e-nessmoderate

e2e-nesscomplex

Page 3: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

Fromtheground-upsecurity…andnowforsomethingcompletelydifferent

Page 4: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

Customer–WebPortalInteraction

host

browser webportal

IPaddress

http/https httpserver

customer

auth nameservers

fullrecursiveresolver

Page 5: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSpoofing

• DNSSpoofingbycachepoisoning• attackerfloodaDNSresolverwithphonyinformationwithbogusDNSresults• bythelawoflargenumbers,theseattacksgetamatchandplantabogusresultintothecache

• Man-in-the-middleattacks• redirecttowrongInternetsites• emailtonon-authorizedemailserver

Page 6: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

The“TooManyCAs”Problem

• TLSclientshaveabundanceofTAs• modernwebbrowsershave1300+TAs• anyofthemcanissuecertificateforexample.com

7

[email protected]

The “Too Many CAs” Problem

● TLS clients often have an abundance of TAs

– Modern web browsers have 1300+ TAs

– Any of them can issue a certificate for example.com

example.com

example.com

The TLS Client Accepts Them Both!!!This has happened multiple times!

TLSclientacceptsboth!

[email protected]

Page 7: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

Customer–WebPortalInteraction

host

browser webportal

IPaddress

http/https httpserver

customer

auth nameservers

fullrecursiveresolver

toomanyCAs

CApinning/HSTS?

Page 8: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSEC-BasedSecureCustomer–WebPortalInteraction

host

browser webportal

IPaddress

http/https httpserver

customer

auth nameservers

fullrecursiveresolver

toomanyCAs

DNSSEC

DANE

Page 9: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

ResolverHijack?!

host

browser webportal

IPaddresshttp/https

httpserver

auth nameservers

fullrecursiveresolver

toomanyCAs

DNSSEC

DANE

Page 10: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

CounteringResolverHijack

• DNSSEConthestub • DNS-over-TLS

The Importance of Being an Earnest stub – OARC 26 5/45Willem Toorop (NLnet Labs)

From the ground-up security

● DNSSEC protects against cache poisoning● But not against resolver hijacking● One possibility: DNSSEC on the stub

DNSSEC AwareRecursiveresolver

Authoritativenet

Authoritative.

Authoritativedns-oarc.net

WebSrv

Browser(application)

OS

stubhttps

DNSKEY DS A

dns-oarc.net

DNSKEY DS

net

DNSKEY

·

THEFIRST/LAST

MILE

The Importance of Being an Earnest stub – OARC 26 6/45Willem Toorop (NLnet Labs)

From the ground-up security/privacy

● DNSSEC protects against cache poisoning● But not against resolver hijacking● Another possibility: DNS over TLS

ValidationRecursiveresolver

Authoritativenet

Authoritative.

Authoritativedns-oarc.net

WebSrv

Browser(application)

OS

stubhttps

dns-oarc.net A

→

←

64.191.0.198

THEFIRST/LAST

MILE

Page 11: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

CounteringResolverHijack(cont’d)

• DNS-over-TLS • DNS-over-TLS

The Importance of Being an Earnest stub – OARC 26 6/45Willem Toorop (NLnet Labs)

From the ground-up security/privacy

● DNSSEC protects against cache poisoning● But not against resolver hijacking● Another possibility: DNS over TLS

ValidationRecursiveresolver

Authoritativenet

Authoritative.

Authoritativedns-oarc.net

WebSrv

Browser(application)

OS

stubhttps

dns-oarc.net A

→

←

64.191.0.198

THEFIRST/LAST

MILETLShijackofDNS-over-TLS BootstraptheTLSAlookupwithregularDNS?

Chickenandeggproblem.

The Importance of Being an Earnest stub – OARC 26 10/45Willem Toorop (NLnet Labs)

ValidationRecursiveresolver

Authoritativenet

Authoritative.

Authoritativegetdnsapi.net

WebSrv

Browser(application)

OS

stub

https

dns-oarc.net A

→

← 64.191.0.198

DNSSEC AwareRecursiveresolver_8

53._tcp.getdnsapi.net TLSA

DNSKEY DS

getdnsapi.net

DNSKEY DS

net

DNSKEY

·

Authoritativedns-oarc.net

From the ground-up security/privacy

● Bootstrap the TLSA lookup with regular DNS?

– Chicken and Egg problem

Authenticate DNS-over-TLS with DANE?

Page 12: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSECDataBlob-over-TLS

• TLSArecord+thecompleteDNSSECauthenticationchainembeddedinaTLSextension• TLSDNSSECauthenticationtoprevent“ToomanyCA’s”problem• https://tools.ietf.org/html/draft-ietf-tls-dnssec-chain-extension

The Importance of Being an Earnest stub – OARC 26 11/45Willem Toorop (NLnet Labs)

ValidationRecursiveresolver

Authoritativenet

Authoritative.

Authoritativegetdnsapi.net

WebSrv

Browser(application)

OS

stub

https

dns-oarc.net A

→

← 64.191.0.198

_853._tcp.getdnsapi.net TLSA getdnsapi.net DNSKEY DS

net DNSKEY DS. DNSKEY

Authoritativedns-oarc.net

RRSIGs

_853._tcp.getdnsapi.net TLSA getdnsapi.net DNSKEY DS

net DNSKEY DS. DNSKEY

RRSIGs

From the ground-up security/privacy

● Bootstrap the TLSA lookup with regular DNS?● Have the TLSA record + the complete DNSSEC

authentication chain embedded in a TLS extensionhttps://tools.ietf.org/html/draft-ietf-tls-dnssec-chain-extension

Page 13: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSPrivacyandStandards

• DNSprivacyrequirements

Capability Standard

DNS-over-TLS RFC7858

Reuse/pipelining/OOOP RFC7766

TCPfast open RFC7413

ENDS0keepalive RFC7828

ENDS0padding RFC7830

PKIXsupportforauthentication (various)

DNSSECsupport(foraddresslookupandauthentication)

(various)

Page 14: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSECRoadblocksConsequencesoflivingontheedge

Page 15: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSECRoadblocks

• ResolvingDNSSEC(tocrossthefirstmile)needsDNSSECawarerecursiveresolver

The Importance of Being an Earnest stub – OARC 26 17/45Willem Toorop (NLnet Labs)

Authoritativenet

Authoritative.

Authoritativedns-oarc.net

WebSrv

Browser(application)

OS

stubhttps

DNSKEY DS A

dns-oarc.net

DNSKEY DS

net

DNSKEY

·

recursiveresolver

DNSSEC Roadblocks

● Resolving DNSSEC (to cross the first mile)needs DNSSEC Aware recursive resolver

Page 16: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSECRoadblockAvoidance

• DNSSECroadblockavoidance+fullrecursioncapability• https://tools.ietf.org/html/rfc8027

Page 17: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSECRoadblockAvoidance

• DNSSECroadblockavoidance+fullrecursioncapability• https://tools.ietf.org/html/rfc8027

Page 18: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

The Importance of Being an Earnest stub – OARC 26 20/45Willem Toorop (NLnet Labs)

DNSSEC Roadblocks

IPv6 Only

DNS64

Authoritativecom

Authoritative.

Authoritativetwitter.com

twitter.co

m AAAA

→←

64:ff9b:

:68e0:2a

c1

IPv4 only

Browser(application)

OS

stub

https

NAT64

104.244.42.193https

● DNSSEC Roadblock Avoidance https://tools.ietf.org/html/rfc8027

● IPv6 Address Synthesis Prefix Discovery https://tools.ietf.org/html/rfc7050+DNS64 capability https://tools.ietf.org/html/rfc6147

DNSSECwithDNS64&NAT64

• JenLinkova’s “Let’stalkaboutIPv6DNS64&DNSSEC”• https://blog.apnic.net/2016/06/09/lets-talk-ipv6-dns64-dnssec/

• WithIPv6prefixdiscovery,stubcandoDNSSECvalidationofARRitself

Page 19: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSECwithDNS64&NAT64

• IPv6addresssynthesisprefixdiscovery+DNS64capability• https://tools.ietf.org/html/rfc7050• https://tools.ietf.org/html/rfc6147

The Importance of Being an Earnest stub – OARC 26 21/45Willem Toorop (NLnet Labs)

DNSSEC Roadblocks

● DNSSEC Roadblock Avoidance https://tools.ietf.org/html/rfc8027

● IPv6 Address Synthesis Prefix Discovery https://tools.ietf.org/html/rfc7050+DNS64 capability https://tools.ietf.org/html/rfc6147

IPv6 Only

DNS64

Authoritativecom

Authoritative.

Authoritativetwitter.com

Browser(application)

OS

stub NAT64Privacyresolver

Page 20: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

KSKRootRolloverMoreroadblocksahead

The Importance of Being an Earnest stub – OARC 26 22/45Willem Toorop (NLnet Labs)

DNSSEC Roadblocks

● DNSSEC validating stubs must do RFC5011

RootKSK

Rollover

Page 21: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

The Importance of Being an Earnest stub – OARC 26 22/45Willem Toorop (NLnet Labs)

DNSSEC Roadblocks

● DNSSEC validating stubs must do RFC5011

RootKSK

Rollover

RFC5011forDNSSECValidatingStubs

• DNSSECvalidatingstubmust doRFC5011

In-bandRFC5011trackingwithDNSSECauth chainTLSextension

Page 22: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

KSKRootRolloverforStubLibrary

• AstublibraryforDANE• runswithuser’sprivileges• nosystemconfig• bootstrapDNSSECcapabilities

• https://tools.ietf.org/html/rfc7958• unbound-anchorfunctionality

The Importance of Being an Earnest stub – OARC 26 22/45Willem Toorop (NLnet Labs)

DNSSEC Roadblocks

● DNSSEC validating stubs must do RFC5011

RootKSK

Rollover

Page 23: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

DNSSECRoadblocksandStandards

• DNSSECstubscapabilityrequirements

Capability Standard

DNSSECvalidation (various)

DNSSECroadblock avoidance RFC8027

IPv6 prefixdiscovery RFC7050

IPv6 addresssynthesis RFC6147

Automatedtrustanchorupdates RFC5011

Automated initialtrustanchorretrieval RFC7958

Page 24: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

LivingontheEdge“FinalThoughts”

Page 25: Living on the Edge: (Re)focus DNS Efforts on the End-Points · Another possibility: DNS over TLS Validation Recursive resolver Authoritative net Authoritative. Authoritative dns-oarc.net

http://www.nlnetlabs.nl/

WrappingUp

• Stubresolver/libraryexperiencecomplexe2e-ness• attheedgeofthenetworkmanykindsofroadblocks/brokenness

• DNS-basedsecurityfromthegroundup• bootstrapswiththestub

• Closingthegapinthelastmilewithongoingwork• overviewofRFCsanddrafts• mostofdiscussedworkisimplementedingetdns anditsstubresolverStubby

• DNSSECAuthenticationChainExtension• https://tools.ietf.org/html/draft-ietf-tls-dnssec-chain-extension


DNSSEC and the Authoritative Root Zone€¦ · DOC Role -The Authoritative Root Zone • The authoritative root zone file is the top of the DNS hierarchy, for which the U.S. Department

Query name minimization and authoritative DNS server behavior€¦ · Title: Query-name minimization and authoritative DNS server behavior Venue: DNS-OARC, May 9th 2015, Amsterdam,

DNS Session 1: Fundamentals - PacNOG · 2017-02-06 · DNS is a distributed database: ... out the wrong answers if the authoritative data changes ... authoritative server −Remember

DNS Zones. DNS records kept in zones DNS server is authoritative for a domain if it hosts the zone for that domain Sub-domains can be kept in same zone

Authoritative DNS-over-TLS Operational Considerations · motivation for authoritative name server operators to weigh the risks and benefits of DNS encryption, hence the importance

Ebook: THE AUTHORITATIVE GUIDE TO DNS TERMINOLOGY - Oracle …pages.dyn.com/rs/dyn/images/DNS+Terminology.pdf · Ebook: THE AUTHORITATIVE GUIDE TO DNS TERMINOLOGY From A Record &

Domain Name System (or Service) (DNS) - Academics | WPIrek/Nets1/B10/DNS_B10.pdf · DNS Outline DNS Hierarchial Structure Root Name Servers Top-Level Domain Servers Authoritative

DNS Security - mcmaster.ca presentations/Session 4... · DNS == Domain Name System . Stub Resolver. Caching Name Server. Authoritative Name Server Function of the DNS

DNS for Dummies ebooksocial.dnsmadeeasy.com/wp-content/uploads/2016/08/DNS-for-Newbies.pdfqueries through: Recursive DNS Servers (or Caching Servers, sounds like "cashing") and Authoritative

Session 3: Authoritative Name Server using BIND9afnog.github.io/sse/dns/dns3-presentation.pdf · Name Server using BIND9. Recap! DNS is a distributed database! Stub asks Resolver

Session 3: Authoritative Name Server using BIND9 · Name Server using BIND9. Recap! DNS is a distributed database! Stub asks Resolver for information! Resolver traverses the DNS delegation

Routing Security DDoS and Route Hijacks - NANOG...DNS server • The malicious DNS authoritative server had a legitimate IP address • These malicious DNS authoritative servers sent

MikroTik DNS Spoofing · data on Authoritative DNS Server or Root DNS with Public Key/Digital Signature DNSCrypt are use Public Key to verifying DNS Server and using TCP/443 From

Measuring ATR - indico.dns-oarc.net · average resolution times and the overall DNS resolution failure rate will fall ... determine if they can accept the tested behavior by observing

TECHNICAL GUIDE TO SECURITY REQUIREMENTS...on authoritative name server Fully Qualified Domain Name (FQDN) and Domain name system (DNS) resource records. • The FQDN of authoritative

Hyperscale and Protect Your DNS, and Optimize …...• Validating caching resolver BIG-IP DNS supports all common DNS deployments that are either authoritative or local resolver DNS

08-Perancangan Aplikasieprints.undip.ac.id/71654/1/turn-C08-Perancangan... · use of DNS authoritative monitoring applications is expected to monitor the work of the DNS server and

Next Steps in DANE Adoption - indico.dns-oarc.net · Verisign Public Brief DNSSEC Deployment Status • DNS Root was signed in July 2010 • Top Level Domains: many are signed [1]:

NXNSAttack:RecursiveDNSInefficienciesandVulnerabilitiescyber-security-group.cs.tau.ac.il/dns-ns-paper.pdf · Authoritative name-server 2.6x 2x NXNSAttack a Recursive resolver 163x

INSERT GRAPHIC SQUARE HERE World Wide Web EPC Network DNS Authoritative system that routes requests for Web sites and email ONS Authoritative record of

Ebook: THE AUTHORITATIVE GUIDE TO DNS TERMINOLOGY …pages.dyn.com/rs/dyn/images/DNS Terminology.pdf · page dyn.com dyn Ebook The Authoritative Guide to DNS Terminology Forward Lookup:

DNS Poisoning: Recent Developments - dns-oarc.net · Note that 16-bit resolution is nearly 100% poisonable in ... (observing TTL). ... no poisoning would result in improved DNS service

DNS and DHCP Best Practices - Com2Distri€¦ · 4 DNS and DHCP Best Practices: Architectures that Work For caching servers: • Separate caching services from authoritative services

Recursives in the Wild: Engineering Authoritative …johnh/PAPERS/Mueller17a.pdfRecursives in the Wild: Engineering Authoritative DNS Servers (extended) ISI-TR-720 1 June 2017 Moritz

DDoS Resilience in the Fast DNS Infrastructure · DDoS Resilience in the Fast DNS Infrastructure Akamai operates an authoritative DNS service similar to Dyn Managed DNS. Akamai architected

What if Everyone Did It? - indico.dns-oarc.net · DNS Resolution Time This measures just the DNS resolution part, collecting the elapsed time between the first and last queries for

Reputation Metrics Design to Improve Intermediary ......problem of non-secure DNS dynamic updates, which allow a cybercriminal to manipulate DNS entries in the zone files of authoritative

Measuring DNSSEC Use - RIPE 67 · Understanding Resolvers is “tricky” What we would like to think happens in DNS resolution! Client DNS Resolver x.y.z? Authoritative Nameserver

Module 3 DNS Types. DNS - Types Master Slave Caching (resolver) Forwarding (Proxy) Stealth (DMZ) Authoritative Only

Recursives in the Wild:Engineering Authoritative …johnh/PAPERS/Mueller17b.pdfRecursives in the Wild: Engineering Authoritative DNS Servers IMC ’17, November 1–3, 2017, London,

Deploying DNSSEC in Windows Server 2012 - DNS-OARC (Indico) · authoritative DNS server 2. That DNS server updates its own copy of the zone and generates signatures 3. The unsigned

IPv6 and the DNS - RIPE 73 · 2016-10-24 · IPv6 DNS questions • DNS is a multi-faceted environment, populated by authoritative name servers who publish information, and client

Purpose  · Web viewWeb server security ... This word, or the terms ... DNS settings should be applied to prevent against DNS poisoning attacks by using only trusted authoritative

BIG-IP DNS Services: Implementations - F5 Networks...DNS Express® is an engine that provides the ability for the BIG-IP ® system to act as a high-speed, authoritative DNS server

DNS Session 2: DNS cache operation and DNS debuggingbrian/doc/dns/dns2-presentation.pdf · DNS Session 2: DNS cache operation and DNS debugging ... the wrong answers if the authoritative