DUKE UNIVERSITY DNSSEC 101 Kevin Miller

DUKE UNIVERSITY DNS Underpins Everything Web Enterprise Systems VoIP IM CMS

DUKE UNIVERSITY DNS Underpins Everything Web Enterprise Systems VoIP IM CMS Inbound Volume Received Spam, virus filtering using DNS Received Spam, virus filtering using DNS 10+ DNS Queries Per Message 10+ DNS Queries Per Message

DUKE UNIVERSITY Risks from DNS Attacks Impersonate your web site Redirect your phone calls Man-in-the-middle (password theft) Reroute or block your Disrupt your network, application services Attack vectors for malware (data theft) Denial of service Diagram source: Internet Storm Center

DUKE UNIVERSITY DNS Attack: Cache Poisoning Where is website.com? Answer: Also, – Answer: Also, –

DUKE UNIVERSITY DNS Attack: Forgery Where is educause.edu? Answer: Answer:

DUKE UNIVERSITY DNS Attack: Indirection Where is educause.edu? Answer:

DUKE UNIVERSITY DNS Attack: Amplification 60 byte request 4000 byte response 4000 byte response

DUKE UNIVERSITY Software Defects Buffer overflow Other vectors Buffer overflow Other vectors

DUKE UNIVERSITY Risk Reduction To Date Improving weaknesses in DNS software – Patching software defects – Limiting cache poisoning opportunities Improve operational best practices – Restrict access to DNS recursers – Install anti-IP spoofing filters Improve host security – Anti-virus, anti-malware defenses Photo source: BCP38

DUKE UNIVERSITY DNSSEC Cryptographically sign DNS records – Also the absence of records Maintains DNS architecture – Hierarchical, distributed signatures Significant risk reduction, if used widely – Protects you ( – Protects your users (

DUKE UNIVERSITY What Can Be Done Now? Discover local implications – How do you manage DNS? What tools are used? – What impact would DNSSEC have? – Do your vendors support it? – Can you servers handle DNSSEC overhead? Begin building expertise, experience – Sign a test zone – Deploy a test DNSSEC recurser Deployment – Sign your zones – Utilize DNSSEC-enabled recurser with DLV

DUKE UNIVERSITY Additional Resources wars.pdf 53wars.pdf