1. Perils of Transitive Trust in the Domain Name System Venugopalan Ramasubramanian Emin Gün Sirer Cornell University

2. How to 0wn the Internet in Your Spare Time? Part 2 Venugopalan Ramasubramanian Emin Gün Sirer Cornell University

3. Introduction DNS is critical to the Internet DNS architecture is based on delegations – control for names is delegated to name servers designated by the name owner delegations facilitate high scalability and decentralized administration – what about security?

4.  sprintlink.net  telemail.net sprintip.com Dependencies for www.fbi.gov vericenter.com  gov.zoneedit.com  zoneedit.com dns[,2].sprintip.com ns[3,4,5,6].vericenter.com fbi.gov gov  com  gtld-servers.net  nstld.com  net zoneedit.com root www.fbi.gov

5. Subtle Dependencies in DNS www.fbi.gov  86 servers, 17 domains www.cs.cornell.edu  cs.rochester.edu  cs.wisc.edu  itd.umich.edu  48 nameservers, 20 domains DNS dependencies are subtle and complex are administrators aware of what they depend on? increases risk of domain hijacks

6. Servers with Security Loopholes www.cs.cornell.edu  [slate,cayuga].cs.rochester.edu source: internet systems consortium (www.isc.org) dns[,2].sprintip.com ns[3,4,5,6].vericenter.com fbi.gov ns[1,2,3]-auth.sprintlink.net reston-ns[1,3].telemail.net reston-ns[2].telemail.net sprintip.com www.fbi.gov

7. Survey Goals 1. Which domain names have large dependencies and entail high risk? 2. Which domains are affected by servers with known security holes and can be easily taken over? 3. Which servers control the largest portion of the namespace and are thus likely to be attacked?

8. Survey Methodology 593160 domain names (Yahoo and Dmoz.org) 166771 name servers 535036 domains, 196 top-level-domain

9. Most Vulnerable Names Number of Dependencies 2226Median 342604Max 6846Mean Top 500All

10. Most Vulnerable Names

11. Vulnerability to Security Flaws survey of BIND version numbers 17% of servers have known loopholes [ISC] 45% of names are not totally safe security through obscurity! – more than 40% of servers hide version numbers – 19/46 reports for cs.cornell.edu and 18/86 for fbi.gov

12. Vulnerability

13. Vulnerability to Security Flaws

14. Critical Assets

15. Most Valuable Nameservers arizona.edu ucla.edu uoregon.edu nyu.edu berkeley.edu Top 5 Domains

16. Conclusions Domain names have subtle dependencies – name-based delegations High risk of domain hijacks – well-known software loopholes – leading to more effective phishing attacks http://www.cs.cornell.edu/people/egs/beehive/codons.php

18. DNS-SEC Security Standard for DNS based on public-key cryptography and digitally signed certificates Not widely used currently – security at delegation points – authenticated denials – islands of security Does not eliminate name-based delegations

19. DNS Bottlenecks

20. Safe Bottlenecks

21. Safety

22. Dependencies

23. Critical Assets 2

24. Dependencies for www.fbi.gov www.fbi.gov fbi.edgesuite.net a33.g.akamai.net ns[1-6].vericenter.com vericenter.com gov  gov.zoneedit.com  zoneedit.com zoneedit.com  com  gtld-servers.net  nstld.com  net edgesuite.net  akam.net g.akamai.net  akamai.net  akamaitech.net dns[,2].sprintip.com ns[3,4,5,6].vericenter.com fbi.gov ns[1,2,3]-auth.sprintlink.net reston-ns[1,2,3].telemail.net sprintip.com