Springe direkt zu Inhalt

Hijacking DNS Subdomains via Subzone Registration: A Case for Signed Zones

Peter Thomassen, Jan Benninger, Marian Margraf – 2018

We investigate how the widespread absence of signatures in DNS (Domain Name System) delegations, in combination with a common misunderstanding with regards to the DNS specification, has led to insecure deployments of authoritative DNS servers which allow for hijacking of subdomains without the domain owner's consent. This, in turn, enables the attacker to perform effective man-in-the-middle attacks on the victim's online services, including TLS (Transport Layer Security) secured connections, without having to touch the victim's DNS zone or leaving a trace on the machine providing the compromised service, such as the web or mail server. Following the practice of responsible disclosure, we present examples of such insecure deployments and suggest remedies for the problem. Most prominently, DNSSEC (Domain Name System Security Extensions) can be used to turn the problem from an integrity breach into a denial-of-service issue, while more thorough user management resolves the issue completely.

Titel
Hijacking DNS Subdomains via Subzone Registration: A Case for Signed Zones
Verfasser
Peter Thomassen, Jan Benninger, Marian Margraf
Verlag
RonPub UG
Datum
2018
Quelle/n
Erschienen in
Open Journal of Web Technologies (OJWT), 5(1), Pages 6-13, 2018
Art
Text
bdr_logo_RGB_300ppi