1. DNS/FCP/論文の構成
Contents
Introduction の最後の部分です。-- ToshinoriMaeno 2018-11-07 22:04:25
We summarise all our attacks, with their requirements,in Table 1.
The requirements are explained in Section 2; for now, it suffices to mention that they all reflect com- mon situations in the current DNS, many of which are not expected to change, even if DNSSEC is fully, universally and correctly deployed.
The main exception is attacks which require partial or incorrect DNSSEC deployment; however, not only is this requirement currently often satisfied, but it is also required only for the ‘domain hijacking’ attack.
In fact, ironically, the use of DNSSEC is often what provides necessary requirements for our attacks to work. Specifically, all of our attacks require ‘Fragmentable zone’, implying fragmented DNS responses; and three of the attacks require ‘Poisonable zone’,
- implying that the second fragment contains complete resource record(s), from the ‘authority’ and/or ‘additional’ sections.
More details on the requirements are presented within.
DNSSEC requires long resource records (RRs) which results in long DNS responses. Long DNS responses (i.e., above 512 byte) require support of the EDNS extension mechanism, [35], and often fragmented when sent over UDP, since their size exceeds the path MTU. It is exactly this fragmentation that facilitates our attacks; e.g., we show that off-path attackers can often replace the sec ond fragment of a packet, resulting in a seemingly-valid, yet fake, DNS response, or ‘merely’ causing corruption of the DNS response. Fragmentation is known to be problematic or ‘harmful’, mainly due to the negative impact on performance; see the seminal paper of Kent and Mogul [23]. As a result, fragmentation is usually avoided, e.g., by use of path MTU discovery [28, 29], mainly for connection-based transport protocol (TCP). However, DNS traffic is usually sent over UDP; while several significant name servers, e.g., com, edu, send long responses over TCP, this may not be a good long-term solution, since the use of TCP results in significant overhead.
2. Contributions
Incremental DNSSEC Deployment is Vulnerable Subdomain Injection Unsigned Delegation We suggest attacks exploiting unsigned NS and A delegation records, breaching privacy and anonymity, and inflicting denial/degradation of service. Name Server (NS) Blocking We introduce the name server blocking technique, which allows an attacker to force the resolver to stop using a particular name server, and eventually, to query a name server of attacker’s choice, e.g., a compromised name server, when resolvers strictly follow RFC 4697 [25]