DNS Spoofing Attack
Dr. Neminath Hubballi
IIT Indore Neminath Hubballi
DNS Basics
We are not good at remembering numbers
Computers work with numbers
Mapping between IP addresses and URLs is maintained
as a service
DNS servers does this job of transforming between
these two
Historically the work done by DNS servers was done
with hosts.txt
Every host maintains a list of mapping IP addresses and
computer names
Was feasible in ARPANET time
Scalability became an issue
IIT Indore Neminath Hubballi
DNS
DNS runs on port 53
Runs on UDP
UDP is a connectionless protocol
Makes it easy for spoofing
DNS is a distributed database maintained in a
hierarchical tree structure
DNS Cache
To improve operational efficiency DNS servers caches
the resource records
Positive caching
Negative caching
IIT Indore Neminath Hubballi
DNS Working
Root
DNS
What is IP of
www.google.com
What is IP of
www.google.com
Its IP is 3.3.3.3
Try at .com its IP is
1.1.1.1
What is IP of
www.google.com
Try at google.com
authoritative DNS it
IP is 2.2.2.2
1.1.1.1
TLD
DNS
What is IP of
www.google.com
Its IP is 3.3.3.3
2.2.2.2
IIT Indore Neminath Hubballi
Autho
ritativ
e
DNS
DNS Components
Resource Records
Internet Domain Namespace
Organizational
Geographical
Reverse domain
Root DNS is at the top
Root DNS is managed by Internet Name Registration Authority
Top Level Domain (TLD)
Bellow root DNS
IIT Indore Neminath Hubballi
Record Types in DNS
Important ones as there are many
A Address record name to 32 bit address
AAAA Address Record name to 128 bit IPV6
address
CNAME Canonical name after receiving this reply
host will query with this new request
NAME
TYPE
VALUE
bar.example.com.
foo.example.com.
CNAME
A
foo.example.com.
92.0.2.23
NS Records Contain IP address of authoritative name server
IIT Indore Neminath Hubballi
Zones in DNS
.com is domain
Microsoft.com is a zone
Zone starts as a database of single
domain
If other domains are added below the
domain used to create the zone
Subdomains can be part of same zone
Dev.microsoft.com
Belong to another zone
Example.microsoft.com
Zone is a subset of domain
IIT Indore Neminath Hubballi
Zone Transfer
When a new DNS server is added
For high availability and fault tolerance
reasons
It starts as a secondary DNS server
All zones hosted in primary are copied to
secondary
IIT Indore Neminath Hubballi
DNS Vulnerability
Getting a wrong answer from the server
Root
DNS
What is IP of
www.google.com
TLD
DNS
Its IP is 4.4.4.4
Autho
ritativ
e
DNS
IIT Indore Neminath Hubballi
DNS Vulnerability
Someone else answers to a DNS query
before the one supposed to answer
What is IP of
www.google.com
Its IP is 3.3.3.3
DNS
Server
Root
DNS
TLD
DNS
Its IP is 4.4.4.4
Maliciou
s guy
IIT Indore Neminath Hubballi
Autho
ritativ
e
DNS
DNS Packet Structure
IIT Indore Neminath Hubballi
DNS Packet Structure
IIT Indore Neminath Hubballi
DNS Poisoning with Host.txt
On a windows machine
Open C:\windows\system32\drivers\etc\host.txt
Add a line like
10.10.10.10 www.iiti.ac.in
Open a webpage and type www.iiti.ac.in it will go
elsewhere
Alternatively create a .bat file with
@echo off
echo 10.10.10.10 www.iiti.ac.in >>
C:\windows\system32\drivers\etc\host.txt
exist
IIT Indore Neminath Hubballi
DNS Spoofing Tools
Dsniff
dnsspoof
Example
abc.com IP address is 10.0.0.1
Make it spoof to respond 100.0.1.1
In the text file dnssniff.txt write
100.0.1.1 abc.com
[gateway]# dnsspoof -i eth0 -f /etc/dnssniff.txt
[bash]# host abc.com
abc.com has address of 100.0.1.1
IIT Indore Neminath Hubballi
DNS Spoofing in Reality
DNS Replies are verified for
Coming from same IP address
Coming to the same port from which request was sent
Reply is for the same record as was asked in the
previous question
Transaction ID match
IIT Indore Neminath Hubballi
How these Verifications are
Overcome
Coming from same IP address
Because authorative DNS server IP address can be
discovered by offline queries
Coming on the same port from which request
was sent
Many DNS servers used static port numbers
Answer is the same question that was asked
This is easy if attacker herself initiates a request
Transaction ID match
Guess it
Dan Kamnisky Attack
Kamnisky Attack
Flood the recursive name server with many
answers
One of them have to be right and it works !
The identifier is not fully random so one can
predict
Dan Kaminisky Attack
Ask a recursive DNS server a question which is most
likely not in its cache
Pick a non existing domain like rnd.india.microsoft.com
With high probability name sever will contact the
authorative name server of microsoft.com domain
Attacker send a reply with canonical name
rnd.india.microsoft.com CNAME IN www.microsoft.com
www.microsoft.com
A
IN 68.177.102.22
IIT Indore Neminath Hubballi
Defending DNS Spoofing
Many solutions focus on increasing the
entropy of DNS query component
Transaction ID
Port number
IIT Indore Neminath Hubballi
DNSSEC
Security extension to DNS protocol
It uses public key infrastructure to give a
guarantee on who is sending the reply
Use private key to digitally sign the message
Use public key to verify the message
Works fine as long as recipient believes in publicprivate key pair of sender
What stops from someone generating her own key
pair and replying
Chain of trust relationship
IIT Indore Neminath Hubballi
How DNSSEC Works
Each DNSSEC zone creates one or more pairs of
public/private key(s)
Public portion put in DNSSEC record type DNSKEY
Zones sign all RRsets with private key(s) and
resolvers use DNSKEY(s) to verify RRsets
Each RRset has a signature attached to it: RRSIG
So, if a resolver has a zones DNSKEY(s) it can
verify that RRsets are intact by verifying their
RRSIGs
Chain of Trust in DNSSEC
Introduces 3 new resource records
RRSIG Signature over RR set using private key
DNSKEY Public key, needed for verifying a RRSIG
DS Delegation Signer; Pointer for building chains of authentication
Authoritative DNS server sends the following with reply
RR containing IP URL mapping
RRSIG
DNSKEY and
DS
Verification can proceed one level higher the hierarchy
At no point a DNS server gives a DS which is bellow it
Problem is effectively addressed if Root Server becomes the highest signature
verifier
As of July 2010 there is one signed root server up and running (http://www.rootdnssec.org/)
IIT Indore Neminath Hubballi
Key References for DNSSEC
http://www.internetsociety.org/deploy360/d
nssec/basics/
http://www.root-dnssec.org/
http://en.wikipedia.org/wiki/Domain_Name
_System_Security_Extensions
IIT Indore Neminath Hubballi
