A wrinkle in time: a case study in DNS poisoning
| Autor: | Moti Geva, Amit Dvir, Harel Berger |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
FOS: Computer and information sciences
021110 strategic defence & security studies Computer Science - Cryptography and Security Computer Networks and Communications Computer science business.industry Domain Name System ComputerSystemsOrganization_COMPUTER-COMMUNICATIONNETWORKS 0211 other engineering and technologies Cryptography 02 engineering and technology Networking hardware Root name server Server Key (cryptography) The Internet DNS spoofing Safety Risk Reliability and Quality business Cryptography and Security (cs.CR) Software Information Systems Computer network |
| Zdroj: | International Journal of Information Security. 20:313-329 |
| ISSN: | 1615-5270 1615-5262 |
| DOI: | 10.1007/s10207-020-00502-x |
| Popis: | The Domain Name System (DNS) provides a translation between readable domain names and IP addresses. The DNS is a key infrastructure component of the Internet and a prime target for a variety of attacks. One of the most significant threat to the DNS's wellbeing is a DNS poisoning attack, in which the DNS responses are maliciously replaced, or poisoned, by an attacker. To identify this kind of attack, we start by an analysis of different kinds of response times. We present an analysis of typical and atypical response times, while differentiating between the different levels of DNS servers' response times, from root servers down to internal caching servers. We successfully identify empirical DNS poisoning attacks based on a novel method for DNS response timing analysis. We then present a system we developed to validate our technique that does not require any changes to the DNS protocol or any existing network equipment. Our validation system tested data from different architectures including LAN and cloud environments and real data from an Internet Service Provider (ISP). Our method and system differ from most other DNS poisoning detection methods and achieved high detection rates exceeding 99%. These findings suggest that when used in conjunction with other methods, they can considerably enhance the accuracy of these methods. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Full text from SpringerLink