Abstract
The Domain Name System (DNS) is a fundamental backbone service of the Internet. In practice, this infrastructure often shows flaws, which indicate that measuring the DNS is important to understand potential (security) issues. Several works deal with the DNS and present such problems, mitigations, and attack vectors. A so far overlooked issue is the fact that DNS servers might answer with information about internal network information (e.g., hostnames) to external queries. This behavior results in a capability to perform an active network reconnaissance without the need for individual vulnerabilities or exploits. Analyzing how public DNS services might involuntarily disclose sensitive information ties in with the trust we have on Internet services.
To investigate this phenomenon, we conducted a systematic measurement study on this topic. We crawl all public reachable DNS servers in 15 scans over a period of almost six months and analyze up to 574,000 DNS servers per run that are configured in a way that might lead to this kind of information leakage. With this large-scale evaluation, we show that the amount of this possible infrastructure leaking DNS servers is on average almost 4% over all of our scans on every reachable DNS servers on the Internet. Based on our newest scan, the countries with most of these servers are Romania, China, and the US. In these countries, the share of such servers among of all reachable servers is about 15% in Romania, 9% in China, and 2.9% in the US. A detailed analysis of the responses reveals that not all answers provide useful information for an adversary. However, we found that up to 158,000 DNS servers provide potentially exploitable information in the wild. Hence, this measurement study demonstrates that the configuration of a DNS server should be executed carefully; otherwise, it may be possible to disclose too much information.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
GeoLite2 Free Downloadable Databases. https://dev.maxmind.com/geoip/geoip2/geolite2/. Accessed 22 Feb 2019
How to prevent bind server resolving private ip addresess and leaking them to external network? https://access.redhat.com/solutions/46558. Accessed 22 Feb 2019
Trust makes it simple. https://intl.alipay.com/. Accessed 22 Feb 2019
University of Oregon Route Views Archive Project. http://archive.routeviews.org. Accessed 22 Feb 2019
When your DNS leaks your infrastructure. https://www.codemetrix.net/when-your-dns-leaks-your-infrastructure/. Accessed 22 Feb 2019
Al-Dalky, R., Schomp, K.: Characterization of collaborative resolution in recursive DNS resolvers. In: Beverly, R., Smaragdakis, G., Feldmann, A. (eds.) PAM 2018. LNCS, vol. 10771, pp. 146–157. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-76481-8_11
Chung, T., et al.: A longitudinal, end-to-end view of the DNSSEC ecosystem. In: USENIX Security Symposium (2017)
Dell’Amico, M., Bilge, L., Kayyoor, A., Efstathopoulos, P., Vervier, P.-A.: Lean on me: mining internet service dependencies from large-scale DNS data. In: Annual Computer Security Applications Conference (ACSAC) (2017)
Durumeric, Z., Adrian, D., Mirian, A., Bailey, M., Halderman, J.A.: A search engine backed by internet-wide scanning. In: 22nd ACM Conference on Computer and Communications Security (2015)
Fiebig, T., Borgolte, K., Hao, S., Kruegel, C., Vigna, G.: Something from nothing (There): collecting global IPv6 datasets from DNS. In: Kaafar, M.A., Uhlig, S., Amann, J. (eds.) PAM 2017. LNCS, vol. 10176, pp. 30–43. Springer, Cham (2017). https://doi.org/10.1007/978-3-319-54328-4_3
Fiebig, T., Borgolte, K., Hao, S., Kruegel, C., Vigna, G., Feldmann, A.: In rDNS we trust: revisiting a common data-source’s reliability. In: Beverly, R., Smaragdakis, G., Feldmann, A. (eds.) PAM 2018. LNCS, vol. 10771, pp. 131–145. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-76481-8_10
Frey, B.J., Dueck, D.: Clustering by passing messages between data points. Science 315, 972–976 (2007)
Fukuda, K., Heidemann, J.: Detecting malicious activity with DNS backscatter. In: ACM SIGCOMM Internet Measurement Conference (IMC) (2015)
Kambourakis, G., Moschos, T., Geneiatakis, D., Gritzalis, S.: Detecting DNS amplification attacks. In: Lopez, J., Hämmerli, B.M. (eds.) CRITIS 2007. LNCS, vol. 5141, pp. 185–196. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-89173-4_16
Kührer, M., Hupperich, T., Bushart, J., Rossow, C., Holz, T.: Going wild: large-scale classification of open DNS resolvers. In: ACM SIGCOMM Internet Measurement Conference (IMC). ACM (2015)
Liu, B., et al.: Who is answering my queries: understanding and characterizing interception of the DNS resolution path. In: USENIX Security Symposium (2018)
Liu, D., Hao, S., Wang, H.: All your DNS records point to us: understanding the security threats of dangling DNS records. In: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (2016)
Padmanabhan, R., Dhamdhere, A., Aben, E., Spring, N., et al.: Reasons dynamic addresses change. In: ACM SIGCOMM Internet Measurement Conference (IMC) (2016)
Pearce, P., et al.: Global measurement of DNS manipulation. In: USENIX Security Symposium (2017)
Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G.: Address Allocation for Private Internets. RFC 1597, RFC Editor, March 1994
Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G., Lear, E.: Address Allocation for Private Internets. RFC 1918, RFC Editor, February 1996
Shaikh, S.A., Chivers, H., Nobles, P., Clark, J.A., Chen, H.: Network reconnaissance. Network Security (2008)
Son, S., Shmatikov, V.: The Hitchhiker’s guide to DNS cache poisoning. In: Jajodia, S., Zhou, J. (eds.) SecureComm 2010. LNICST, vol. 50, pp. 466–483. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-16161-2_27
van Rijswijk-Deij, R., Jonker, M., Sperotto, A., Pras, A.: A high-performance, scalable infrastructure for large-scale active DNS measurements. IEEE J. Sel. Areas Commun. 34, 1877–1888 (2016)
Woolf, S., Conrad, D.: Requirements for a Mechanism Identifying a Name Server Instance. RFC 4892, RFC Editor, June 2007
Acknowledgment
This work was partially supported by the German Federal Ministry of Education and Research (BMBF grant 16KIS0395 “secUnity”). We would like to thank the anonymous reviewers for their valuable feedback.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2019 Springer Nature Switzerland AG
About this paper
Cite this paper
Tatang, D., Schneider, C., Holz, T. (2019). Large-Scale Analysis of Infrastructure-Leaking DNS Servers. In: Perdisci, R., Maurice, C., Giacinto, G., Almgren, M. (eds) Detection of Intrusions and Malware, and Vulnerability Assessment. DIMVA 2019. Lecture Notes in Computer Science(), vol 11543. Springer, Cham. https://doi.org/10.1007/978-3-030-22038-9_17
Download citation
DOI: https://doi.org/10.1007/978-3-030-22038-9_17
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-030-22037-2
Online ISBN: 978-3-030-22038-9
eBook Packages: Computer ScienceComputer Science (R0)