The Experts below are selected from a list of 9669 Experts worldwide ranked by ideXlab platform

Rd D. Eastlake - One of the best experts on this subject based on the ideXlab platform.

Steven M Bellovin - One of the best experts on this subject based on the ideXlab platform.

  • using the domain name system for system break ins
    USENIX Security Symposium, 1995
    Co-Authors: Steven M Bellovin
    Abstract:

    The DARPA Internet uses the domain name system (DNS), a distributed database, to map host names to network addresses, and vice-versa. Using a vulnerability first noticed by P.V. Mockapetris, we demonstrate how the DNS can be abused to subvert system security. We also show what tools are useful to the attacker. Possible defenses against this attack, including one implemented by Berkeley in response to our reports of this problem, are discussed, and the limitations on their applicability are demonstrated. This paper was written in 1990, and was withheld from publication by the author. The body of the paper is unchanged, even to the extreme of giving the size of the Internet as 200,000 hosts. An epilogue has been added that discusses why it was held back, and why it is now being released.

  • USENIX Security Symposium - Using the domain name system for system break-ins
    1995
    Co-Authors: Steven M Bellovin
    Abstract:

    The DARPA Internet uses the domain name system (DNS), a distributed database, to map host names to network addresses, and vice-versa. Using a vulnerability first noticed by P.V. Mockapetris, we demonstrate how the DNS can be abused to subvert system security. We also show what tools are useful to the attacker. Possible defenses against this attack, including one implemented by Berkeley in response to our reports of this problem, are discussed, and the limitations on their applicability are demonstrated. This paper was written in 1990, and was withheld from publication by the author. The body of the paper is unchanged, even to the extreme of giving the size of the Internet as 200,000 hosts. An epilogue has been added that discusses why it was held back, and why it is now being released.

Scott Rose - One of the best experts on this subject based on the ideXlab platform.

  • Open Issues in Secure domain name system (DNS) Deployment
    IEEE Security & Privacy Magazine, 2009
    Co-Authors: Ramaswamy Chandramouli, Scott Rose
    Abstract:

    The domain name system (DNS) is the primary infrastructure component of the Internet as it translates easy-to-remember Internet destination (web pages, mail servers) addresses (called URLs) into actual network addresses (IP addresses). Being the foundational technology for the Global economy, the DNS needs protection using state of practice security measures. A set of security specifications called DNS Security Extensions (DNSSEC) specification has been proposed by IETF and has been demonstrated to provide the needed protection. However ubiquitous DNSSEC deployment throughout the DNS infrastructure calls for certain critical security operations. There are some unresolved issues with respect to the rollout of these operations in terms of specification gaps, consensus security procedures and operational challenges. This article discusses those issues and provides some directions for resolving them.

  • Information Leakage through the domain name system
    2009 Cybersecurity Applications & Technology Conference for Homeland Security, 2009
    Co-Authors: Scott Rose, Ramaswamy Chandramouli, Anastase Nakassis
    Abstract:

    The domain name system (DNS) is the global lookup service for network resources. It is often the first step in an Internet transaction as well as a network attack since it provides the route map for reaching any resource (e.g., hosts) in any organization irrespective of its geographical and network location. An attacker can query an organization’s DNS as reconnaissance before attacking hosts on a particular network. To minimize the chances of these attacks succeeding, the administrator of an organization’s DNS (called the zone administrator), has various counter measures options in the form of content control, configuration, protocols, operational and infrastructure protection methods. In this paper, we analyze these and discuss the ireffectiveness and limitations.

  • Secure domain name system (DNS) deployment guide
    NIST Special Publication, 2006
    Co-Authors: Rajarathnam Chandramouli, Scott Rose
    Abstract:

    The domain name system (DNS) is a distributed computing system that enables access to Internet resources by user-friendly domain names rather than IP addresses, by translating domain names to IP addresses and back. The DNS infrastructure is made up of computing and communication entities called name Servers each of which contains information about a small portion of the domain name space. The domain name data provided by DNS is intended to be available to any computer located anywhere in the Internet.This document provides deployment guidelines for securing DNS within an enterprise. Because DNS data is meant to be public, preserving the confidentiality of DNS data. The primary security goals for DNS are data integrity and source authentication, which are needed to ensure the authenticity of domain name information and maintain the integrity of domain name information in transit. This document provides extensive guidance on maintaining data integrity and performing source authentication. DNS components are often subjected to denial-of-service attacks intended to disrupt access to the resources whose domain names are handled by the attacked DNS components. This document presents guidelines for configuring DNS deployments to prevent many denial-of-service attacks that exploit vulnerabilities in various DNS components.

Fan Lei - One of the best experts on this subject based on the ideXlab platform.

  • Detection of domain name system Cache Attack Based on Cumulative Sum Algorithm
    Computer Engineering, 2011
    Co-Authors: Fan Lei
    Abstract:

    Aiming at the domain name system(DNS) attack,this paper proposes a simple and robust detection mechanism.The core of this mechanism is based on the inherent DNS protocol behaviors and applies an instance of change point detection algorithm to detect attack behavior.To make the detection mechanism insensitive to attack and low computational complexity,based on the nonparametric Cumulative Sum(CUSUM) algorithm,it makes some improvements in view of DNS protocol behavior.Simulation results show the mechanism can detect the DNS attack,it makes good compromise between the detection rate and the false alarm rate.

Krishna Kant - One of the best experts on this subject based on the ideXlab platform.

  • INFOCOM - Measuring Availability in the domain name system
    2010 Proceedings IEEE INFOCOM, 2010
    Co-Authors: Casey Deccio, Jeff Sedayao, Krishna Kant, Prasant Mohapatra
    Abstract:

    The domain name system (DNS) is critical to Internet functionality. The availability of a domain name refers to its ability to be resolved correctly. We develop a model for server dependencies that is used as a basis for measuring availability. We introduce the minimum number of servers queried (MSQ) and redundancy as availability metrics and show how common DNS misconfigurations impact the availability of domain names. We apply the availability model to domain names from production DNS and observe that 6.7% of names exhibit sub-optimal MSQ, and 14% experience false redundancy. The MSQ and redundancy values can be optimized by proper maintenance of delegation records for zones.

  • ICNP - Quality of name resolution in the domain name system
    2009 17th IEEE International Conference on Network Protocols, 2009
    Co-Authors: Casey Deccio, Jeff Sedayao, Prasant Mohapatra, Chao-chih Chen, Krishna Kant
    Abstract:

    The domain name system (DNS) is integral to today's Internet. name resolution for a domain is often dependent on servers well outside the control of the domain's owner. In this paper we propose a formal model for analyzing the name dependencies inherent in DNS, based on protocol specification and actual implementations. We derive metrics to quantify the extent to which domain names affect other domain names. It is found that under certain conditions, the name resolution for over one-half of the queries exhibits influence of domains not expressly configured by administrators. This result serves to quantify the degree of vulnerability of DNS due to dependencies that administrators are unaware of. The model presented in the paper also shows that the set of domains whose resolution affects a given domain name is much smaller than previously thought. The model also shows that with caching of NS target addresses, the number of influential domains expands greatly, thereby making the DNS infrastructure more vulnerable.