4 ms·

There is already DNSSEC is you care about these kinds of attacks.

by phicoh 7y ago

amarshall 7y ago
DNSSEC doesn’t really do anything against a BGP attack, since it’s redirecting IPs. So even if the DNS record is signed the same IP goes somewhere else.
- phicoh 7y ago
  This is described as an attack on DNS. DNSSEC protects again these kinds of attacks. If you then want to use the IP address to connect to a web server, then you can use TLS. Which, in the case of letsencrypt, again depends on DNS to prevent issuing a certificate to the wrong party. So if you start with securing DNS, then you can bootstrap from that into securing higher level protocols. At the moment there is no practical technique to prevent route hijacks using BGP. So it is best to consider that insecure.
- tialaramex 7y ago
  One of the records you can write into DNS, where it can be protected by DNSSEC, is CAA. The CAA record tells a Certificate Authority what policies you have about certificates. The high level (if CAA is present) is just which CAs are allowed to issue for this part of the DNS hierarchy at all. As an example, you can forbid Let's Encrypt outright, if you so choose. CAs can also define more nuanced policies, so when they define one you could instead require Let's Encrypt but only with DNS (and thus DNSSEC verification). Because the Ten Blessed Methods have associated OIDs the CAs could (but so far as I know haven't plans to) have a way to say I'm OK with anybody issuing so long as they used a method with DNSSEC checks. Now, as Thomas Ptacek points out previously, banks like many other security critical organisations have lousy security and so none of this will get done, but that's because they're bad at what they do, as is illustrated by them causing a global financial crisis. They're bad at real world security too, plus ca change.
jedisct1 7y ago
Nobody's using DNSSEC, especially in Asia.
- danyork 7y ago
  Actually, about 16% of all DNS queries in Asia are being validated by DNSSEC, per APNIC Labs: https://stats.labs.apnic.net/dnssec/XD?hc=XD&hx=1&hg=1&hr=1&w=30&g=0 https://stats.labs.apnic.net/dnssec/XD?hc=XD&hx=1&hg=1&hr=1&... And if you scroll down the page you will see that validation rates are significantly higher in some countries in Asia.
  - tptacek 7y ago
    Routing queries through a centralized resolver service that happens to do performative DNSSEC checking is not the same thing as "using DNSSEC". Rather: go to any list of the top domains in any Asian country and take them to "DNSSEC-NAME-AND-SHAME.COM" to see if they're actually signed. Yahoo.co.jp? Rakuten? Google.co.jp? Nope, nope, and nope.

There is already DNSSEC is you care about these kinds of attacks.

by phicoh 7y ago

There is already DNSSEC is you care about these kinds of attacks.

DNSSEC doesn’t really do anything against a BGP attack, since it’s redirecting IPs. So even if the DNS record is signed the same IP goes somewhere else.

phicoh 7y ago
This is described as an attack on DNS. DNSSEC protects again these kinds of attacks. If you then want to use the IP address to connect to a web server, then you can use TLS. Which, in the case of letsencrypt, again depends on DNS to prevent issuing a certificate to the wrong party. So if you start with securing DNS, then you can bootstrap from that into securing higher level protocols. At the moment there is no practical technique to prevent route hijacks using BGP. So it is best to consider that insecure.
tialaramex 7y ago
One of the records you can write into DNS, where it can be protected by DNSSEC, is CAA. The CAA record tells a Certificate Authority what policies you have about certificates. The high level (if CAA is present) is just which CAs are allowed to issue for this part of the DNS hierarchy at all. As an example, you can forbid Let's Encrypt outright, if you so choose. CAs can also define more nuanced policies, so when they define one you could instead require Let's Encrypt but only with DNS (and thus DNSSEC verification). Because the Ten Blessed Methods have associated OIDs the CAs could (but so far as I know haven't plans to) have a way to say I'm OK with anybody issuing so long as they used a method with DNSSEC checks. Now, as Thomas Ptacek points out previously, banks like many other security critical organisations have lousy security and so none of this will get done, but that's because they're bad at what they do, as is illustrated by them causing a global financial crisis. They're bad at real world security too, plus ca change.

jedisct1 7y ago

Nobody's using DNSSEC, especially in Asia.

danyork 7y ago
Actually, about 16% of all DNS queries in Asia are being validated by DNSSEC, per APNIC Labs: https://stats.labs.apnic.net/dnssec/XD?hc=XD&hx=1&hg=1&hr=1&w=30&g=0 https://stats.labs.apnic.net/dnssec/XD?hc=XD&hx=1&hg=1&hr=1&... And if you scroll down the page you will see that validation rates are significantly higher in some countries in Asia.
- tptacek 7y ago
  Routing queries through a centralized resolver service that happens to do performative DNSSEC checking is not the same thing as "using DNSSEC". Rather: go to any list of the top domains in any Asian country and take them to "DNSSEC-NAME-AND-SHAME.COM" to see if they're actually signed. Yahoo.co.jp? Rakuten? Google.co.jp? Nope, nope, and nope.