Homework 2

DNS and Attacks

1. Bob wants to launch a Kaminsky DNS cache poisoning attack on a recursive DNS resolver; his goal is to get the resolver to cache a false IP address for the hostname www.example.com. Bob knows that during the iterative process, a query will be sent to the root server, then to the .COM nameserver, and finally to the example.com’s nameserver. He can choose to spoof replies from any of these nameservers, after triggering the iterative process from the resolver. He decides to spoof a reply from the .COM server. Please describe whether Bob’s attack will be successful or not.

2. Bob wants to launch a Kaminsky DNS cache poisoning attack on a recursive DNS resolver, but his machine does not have a hostname (he launches the attack from a coffee shop using its Wi-Fi). He plans to use a random hostname in the authority section, and then provides his machine’s IP address in the additional section. See the following portion of his spoofed reply. Would this approach work?

;; AUTHORITY SECTION:

example.com. 259200 IN NS ns.ARandomName.net

;; ADDITIONAL SECTION:

ns.ARandomName.net 259200 IN A 132.2.1.4

3. Company XYZ sets up a website www.example.com for its internal use only, so only computers inside the company can access it. Instead of setting up a firewall to limit the access, the administrator of the web server decides to use reverse DNS lookup to check whether a client belongs to the company or not. For example, when an HTTP request comes in, the web server extracts the IP address from the request packet, conducts a reverse DNS lookup to get the hostname corresponding to the IP address. If the hostname ends with example.com, access is granted; otherwise, access is denied. You are an outsider, can you find a way to access this website?  

4. DNS root servers use IP Anycast to improve its scalability, which is essential against DDoS attacks. IP Anycast allows many computers to share the same IP address. These computers are typically distributed geographically. Packets to an Anycast IP address will be routed to any one of these computers, selected on the basis of which is the nearest, lowest cost, with the least congested route, or some other distance measure. Please describe how DNS root servers use this technology to achieve scalability. (hint: check Anycast from Wikipedia)

5.  In the DNS rebinding attack, if the victim’s browser caches the IP address for any hostname used in HTTP requests for an hour, can the attack still be successful? Why?