揭示DNS解析路径拦截：安全与隐私挑战

需积分: 9 200 浏览量更新于2024-07-18 收藏 3.09MB PDF 举报

"《理解与刻画DNS解析路径的拦截》是一篇收录于2018年第27届USENIX安全研讨会的论文，该会议在马里兰州巴尔的摩举行。作者们探讨了DNS（域名系统）查询在互联网中的关键过程，特别是当终端用户发起查询时，这些查询通常由递归DNS服务器处理以实现网络的可扩展性和性能。文章关注的核心问题是隐藏的DNS解析路径拦截，即某些设备可能伪装成用户指定的DNS服务器，未经授权地截取和处理用户的查询，从而对用户的隐私和网络安全构成潜在威胁。研究者们通过大规模的分析，利用全球超过148,478个住宅和移动网络IP地址进行了深入探究。他们的发现令人不安，结果显示在调查的3047个自治系统中，有259个存在DNS拦截行为，其中包括像中国移动这样的大型互联网服务提供商。这表明DNS拦截并非孤立现象，而是涉及多个关键网络基础设施。值得注意的是，这些拦截请求往往来自使用过时且可能存在漏洞的DNS服务器，例如使用了2009年前已被弃用的软件版本。这些服务器不仅缺乏必要的安全功能，如处理DNSSEC（DNS安全扩展）请求，使得攻击者可以更容易地利用这些弱点进行攻击。论文强调了DNS解析路径拦截的重要性和其带来的安全隐患，同时提出了对于这个问题的新认识和解决策略。它提倡用户应该有更多的选择权，可以自主选择DNS服务器，同时敦促网络服务提供商和政策制定者采取措施加强DNS系统的安全性，确保用户的数据隐私和网络通信不受干扰。这篇论文的成果对网络安全专家、政策制定者以及互联网用户来说都具有重要的参考价值，促进了对DNS拦截问题的深入理解和应对策略的发展。"

Figure 1: Domain resolution process with a recursive resolver

2 Threat Model and Mechanisms

In this section, we ﬁrst give an overview of how domain

names are translated into addresses using DNS. Then we

introduce our threat model of DNSIntercept, with a tax-

onomy of interception paths according to our observa-

tion. Finally, we discuss the potential interceptors and

their behaviors.

2.1 Domain Resolution Process

DNS is a hierarchical naming system organized to han-

dle domain resolutions at different levels. At the top of

the hierarchy is DNS root which manages Top-Level Do-

mains (TLD) resolutions. Second-Level Domains (SLD)

are delegated to resolvers below DNS root. Consisting

of labels from all domain levels, a fully qualiﬁed domain

name (FQDN) speciﬁes its exact location in the DNS

hierarchy, from its lowest level to root. As a example,

www.example.com is an FQDN, and its corresponding

TLD and SLD are com and example.com.

When a client requests resolution of a domain, the res-

olution is typically executed by a recursive DNS resolver

at ﬁrst, which can be either assigned by ISP or speciﬁed

by Internet users. Illustrated in Figure 1, the recursive

resolver iteratively contacts root, TLD and SLD name-

servers to resolve a domain name, and eventually returns

the answer to the client. Therefore, intercepting DNS

trafﬁc to a recursive resolver directly affects the domain

resolution process for users.

2.2 Threat Model

Figure 2 presents our threat model. We assume that

users’ DNS resolution requests are monitored by on-path

devices. These on-path devices are able to intercept and

selectively manipulate the route of DNS requests (e.g.,

by inspecting destinations and ports) which are sent to re-

cursive resolvers like public DNS servers originally. The

on-path devices either redirect or replicate the requests

to alternative resolvers (typically, local DNS resolvers),

which perform the standard resolution process. Finally,

before responses are sent from alternative resolvers back

to clients, the sources are replaced with addresses of the

Figure 2: Threat model

Figure 3: Four DNS resolution paths (request shown only)

original resolvers. Therefore, from a client’s perspective,

DNS responses appear to come from the original DNS

resolvers according to their source addresses, making the

actual interception behaviors difﬁcult to be discerned.

By default, in order to handle DNS requests, Internet

users are assigned with local DNS resolvers by ISPs. In

the mean time, users reserve the right to specify their

preferred recursive resolvers to launch DNS requests (in

particular, public DNS servers). However, our study

shows that, for users using designated DNS servers, not

only does DNSIntercept violate the will of users, but it

also can bring in security issues.

Scope of study. We aim to measure and characterize

DNSIntercept through large-scale data analysis. We

focus on how DNS resolution paths between clients and

well-known public DNS resolvers are tampered. Other

types of network trafﬁc manipulation mechanisms, such

as BGP preﬁx hijacking [51] and unauthorized manipu-

lation of DNS root servers [27], which have been system-

atically studied before, are not considered in our study.

Taxonomy of DNS resolution paths. In this study, we

classify the mechanisms of DNS resolution into four cat-

egories, based on how the resolution path is constructed

during the stage of the request. Except for Normal res-

olution, all the other three scenarios are regarded as

DNSIntercept. Figure 3 presents the paths of DNS re-

quests in the four DNS resolution mechanisms.

• Normal resolution. The resolution strictly follows the

standard process. A DNS query sent by client only

reaches the speciﬁed resolver, without being modiﬁed

by any on-path device. The speciﬁed resolver per-

forms the resolution by contacting authoritative name-

servers if the resolution is not cached.

• Request redirection. The original DNS query sent to

USENIX Association 27th USENIX Security Symposium 1115

剩余16页未读，继续阅读

www_helloworld_com

粉丝: 252
资源: 4

揭示DNS解析路径拦截：安全与隐私挑战

Understanding and Characterizing Interception of the DNS Resolution Path'PPT

the code of using the second moment beam width to calculate the beam radius

Pitfalls and Tradeoffs in Simultaneous, On-Chip FPGA Delay Measurement

characterizing and avoiding negative transfer

characterizing differential amplifiers for communications circuits

给出一个关于牙齿分割的最优化实际问题，用数学语言描述并且给出python代码解决

厦门理工学院在广东2021-2024各专业最低录取分数及位次表.pdf

算法竞赛学习资源114514

基于ssm汽车在线销售系统设计与实现.docx

河南中医药大学在广东2021-2024各专业最低录取分数及位次表.pdf

最新资源