WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks

Roberto Perdisci; Manos Antonakakis; Xiapu Luo; Wenke Lee

doi:10.1109/DSN.2009.5270363

WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks

Roberto Perdisci, Manos Antonakakis, Xiapu Luo, Wenke Lee

Research output: Chapter in book / Conference proceeding › Conference article published in proceeding or book › Academic research › peer-review

34 Citations (Scopus)

Abstract

Recently, a new attack for poisoning the cache of Recursive DNS (RDNS) resolvers was discovered and revealed to the public. In response, major DNS vendors released a patch to their software. However, the released patch does not completely protect DNS servers from cache poisoning attacks in a number of practical scenarios. DNSSEC seems to offer a definitive solution to the vulnerabilities of the DNS protocol, but unfortunately DNSSEC has not yet been widely deployed. In this paper, we proposeWild-card SECure DNS (WSEC DNS), a novel solution to DNS cache poisoning attacks. WSEC DNS relies on existing properties of the DNS protocol and is based on wild-card domain names. We show that WSEC DNS is able to decrease the probability of success of cache poisoning attacks by several orders of magnitude. That is, with WSEC DNS in place, an attacker has to persistently run a cache poisoning attack for years, before having a non-negligible chance of success. Furthermore, WSEC DNS offers complete backward compatibility to DNS servers that may for any reason decide not to implement it, therefore allowing an incremental large-scale deployment. Contrary to DNSSEC, WSEC DNS is deployable immediately because it does not have the technical and political problems that have so far hampered a large-scale deployment of DNSSEC.

Original language	English
Title of host publication	Proceedings of the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009
Pages	3-12
Number of pages	10
DOIs	https://doi.org/10.1109/DSN.2009.5270363
Publication status	Published - 25 Nov 2009
Externally published	Yes
Event	2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009 - Lisbon, Portugal Duration: 29 Jun 2009 → 2 Jul 2009

Conference

Conference	2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009
Country	Portugal
City	Lisbon
Period	29/06/09 → 2/07/09

ASJC Scopus subject areas

Software
Hardware and Architecture
Computer Networks and Communications

More information

10.1109/DSN.2009.5270363

Scopus Link

Cite this

@inproceedings{dce1adcbcc8740f9b02dacacd7f921e7,

title = "WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks",

abstract = "Recently, a new attack for poisoning the cache of Recursive DNS (RDNS) resolvers was discovered and revealed to the public. In response, major DNS vendors released a patch to their software. However, the released patch does not completely protect DNS servers from cache poisoning attacks in a number of practical scenarios. DNSSEC seems to offer a definitive solution to the vulnerabilities of the DNS protocol, but unfortunately DNSSEC has not yet been widely deployed. In this paper, we proposeWild-card SECure DNS (WSEC DNS), a novel solution to DNS cache poisoning attacks. WSEC DNS relies on existing properties of the DNS protocol and is based on wild-card domain names. We show that WSEC DNS is able to decrease the probability of success of cache poisoning attacks by several orders of magnitude. That is, with WSEC DNS in place, an attacker has to persistently run a cache poisoning attack for years, before having a non-negligible chance of success. Furthermore, WSEC DNS offers complete backward compatibility to DNS servers that may for any reason decide not to implement it, therefore allowing an incremental large-scale deployment. Contrary to DNSSEC, WSEC DNS is deployable immediately because it does not have the technical and political problems that have so far hampered a large-scale deployment of DNSSEC.",

author = "Roberto Perdisci and Manos Antonakakis and Xiapu Luo and Wenke Lee",

year = "2009",

month = nov,

day = "25",

doi = "10.1109/DSN.2009.5270363",

language = "English",

isbn = "9781424444212",

pages = "3--12",

booktitle = "Proceedings of the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009",

note = "2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009 ; Conference date: 29-06-2009 Through 02-07-2009",

}

Perdisci, R, Antonakakis, M, Luo, X & Lee, W 2009, WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks. in Proceedings of the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009., 5270363, pp. 3-12, 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009, Lisbon, Portugal, 29/06/09. https://doi.org/10.1109/DSN.2009.5270363

WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks. / Perdisci, Roberto; Antonakakis, Manos; Luo, Xiapu; Lee, Wenke.

Proceedings of the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009. 2009. p. 3-12 5270363.

Research output: Chapter in book / Conference proceeding › Conference article published in proceeding or book › Academic research › peer-review

TY - GEN

T1 - WSEC DNS: Protecting recursive DNS resolvers from poisoning attacks

AU - Perdisci, Roberto

AU - Antonakakis, Manos

AU - Luo, Xiapu

AU - Lee, Wenke

PY - 2009/11/25

Y1 - 2009/11/25

N2 - Recently, a new attack for poisoning the cache of Recursive DNS (RDNS) resolvers was discovered and revealed to the public. In response, major DNS vendors released a patch to their software. However, the released patch does not completely protect DNS servers from cache poisoning attacks in a number of practical scenarios. DNSSEC seems to offer a definitive solution to the vulnerabilities of the DNS protocol, but unfortunately DNSSEC has not yet been widely deployed. In this paper, we proposeWild-card SECure DNS (WSEC DNS), a novel solution to DNS cache poisoning attacks. WSEC DNS relies on existing properties of the DNS protocol and is based on wild-card domain names. We show that WSEC DNS is able to decrease the probability of success of cache poisoning attacks by several orders of magnitude. That is, with WSEC DNS in place, an attacker has to persistently run a cache poisoning attack for years, before having a non-negligible chance of success. Furthermore, WSEC DNS offers complete backward compatibility to DNS servers that may for any reason decide not to implement it, therefore allowing an incremental large-scale deployment. Contrary to DNSSEC, WSEC DNS is deployable immediately because it does not have the technical and political problems that have so far hampered a large-scale deployment of DNSSEC.

AB - Recently, a new attack for poisoning the cache of Recursive DNS (RDNS) resolvers was discovered and revealed to the public. In response, major DNS vendors released a patch to their software. However, the released patch does not completely protect DNS servers from cache poisoning attacks in a number of practical scenarios. DNSSEC seems to offer a definitive solution to the vulnerabilities of the DNS protocol, but unfortunately DNSSEC has not yet been widely deployed. In this paper, we proposeWild-card SECure DNS (WSEC DNS), a novel solution to DNS cache poisoning attacks. WSEC DNS relies on existing properties of the DNS protocol and is based on wild-card domain names. We show that WSEC DNS is able to decrease the probability of success of cache poisoning attacks by several orders of magnitude. That is, with WSEC DNS in place, an attacker has to persistently run a cache poisoning attack for years, before having a non-negligible chance of success. Furthermore, WSEC DNS offers complete backward compatibility to DNS servers that may for any reason decide not to implement it, therefore allowing an incremental large-scale deployment. Contrary to DNSSEC, WSEC DNS is deployable immediately because it does not have the technical and political problems that have so far hampered a large-scale deployment of DNSSEC.

UR - http://www.scopus.com/inward/record.url?scp=70449922005&partnerID=8YFLogxK

U2 - 10.1109/DSN.2009.5270363

DO - 10.1109/DSN.2009.5270363

M3 - Conference article published in proceeding or book

SN - 9781424444212

SP - 3

EP - 12

BT - Proceedings of the 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009

T2 - 2009 IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2009

Y2 - 29 June 2009 through 2 July 2009

ER -