Large-scale Analysis of Infrastructure-leaking DNS Servers Dennis - PowerPoint PPT Presentation

Large-scale Analysis of Infrastructure-leaking DNS Servers Dennis Tatang , Carl Schneider, Thorsten Holz Ruhr-University Bochum, Germany

Motivation • DNS: www.rub.de 134.147.64.10 • Daily use on the Internet by every user • Various studies: DDoS, Censorship, Measurements • Overlooked aspect: Leaking DNS servers to external queries with internal network information DIMVA 2019, Gothenburg

Reconnaissance • Information leakage part of active infrastructure reconnaissance • Goal: Get as much information as possible about a target network DIMVA 2019, Gothenburg

Contributions • Measurement approach to find information leaking DNS servers • Systematic study on DNS servers that might expose internal network information to external requests • Self-check for identifying information-leaking DNS servers DIMVA 2019, Gothenburg

Domain Name System (DNS) • Distributed, hierarchy-based service • Primarily responsible for translation of domain names into IP addresses (A, AAAA) • Reverse lookup (PTR) • Private IP ranges ( 10/8 , 172.16/12 , 192.168/16 ) DIMVA 2019, Gothenburg

Idea • Using reverse DNS requests for internal resources on Internet reachable DNS servers DIMVA 2019, Gothenburg

Discovering Leaking DNS Servers DNS server IPv4 Censys database Scan server DNS server ... Private networks ... DIMVA 2019, Gothenburg

Discovering Leaking DNS Servers 3 requests per private IP range DNS server IPv4 Censys database Scan server DNS server ... Private networks ... DIMVA 2019, Gothenburg

General Measurement Results 10.000.000 8.000.000 6.000.000 4.000.000 2.000.000 0 2018-09-08 2018-10-08 2018-11-08 2018-12-08 2019-01-08 800.000 600.000 400.000 200.000 0 2018-09-08 2018-10-08 2018-11-08 2018-12-08 2019-01-08 DIMVA 2019, Gothenburg

Response Groups (1) Localhost : “localhost.” Single : one host Emptyresponse : “.” IP : IP addresses Arpa : Reverse DNS Bogon : “bogon.” Constant : unique hostname for all hosts DIMVA 2019, Gothenburg

Response Groups (2) Enduser : Keyword-based Other • apple, iphone, ipad, samsung, galaxy, home DIMVA 2019, Gothenburg

Response Groups (3) No information Active hosts, Active hosts, advantage used subnet used subnet, hostnames Bogon Localhost Emptyresponse Constant Arpa Enduser IP Single Other DIMVA 2019, Gothenburg

General Measurement Results 600.000 500.000 400.000 300.000 200.000 100.000 0 2018-09-08 2018-10-08 2018-11-08 2018-12-08 2019-01-08 localhost single ip emptyresponse constant other enduser arpa bogon DIMVA 2019, Gothenburg

In-depth Analysis • Daemon information • AS numbers • Countries • Private IP ranges • Hostname pattern analysis DIMVA 2019, Gothenburg

Daemon Information 80.000 100% 90% 70.000 80% 60.000 70% 50.000 60% 40.000 50% 40% 30.000 30% 20.000 20% 10.000 10% 0% 0 2018-10-01 2018-11-01 2018-12-01 2019-01-01 2018-10-01 2018-11-01 2018-12-01 2019-01-01 dnsmasq BIND MS DNS PowerDNS dnsmasq BIND MS DNS PowerDNS DIMVA 2019, Gothenburg

AS Numbers & Countries DIMVA 2019, Gothenburg

AS Numbers & Countries DIMVA 2019, Gothenburg

Countries (normalized) Country Share Count British Virgin Islands 80% 2,533 Macao 41% 898 Comoros 29% 14 DIMVA 2019, Gothenburg

Countries (normalized) Country Share Count British Virgin Islands 80% 2,533 Macao 41% 898 Comoros 29% 14 Country Share China 9% USA 3% Romania 15% Russia 3.4% DIMVA 2019, Gothenburg

Private IP Ranges 100% 80% 60% 40% 20% 0% 192.168.0.0/16 10.0.0.0/8 172.16.0.0/12 DIMVA 2019, Gothenburg

Hostname Pattern Analysis DIMVA 2019, Gothenburg

Hostname Pattern Analysis Other Enduser 73 clusters 45 clusters DIMVA 2019, Gothenburg

Example Hostname Patterns • <placeholder>.iPhone , <placeholder>.iPad • android-<placeholder> • amazon-<placeholder> • <placeholder>desktop, <placeholder>-PC • Other: • firewall<placeholder>, <placeholder>.dmz DIMVA 2019, Gothenburg

Mitigation & Self-Check DIMVA 2019, Gothenburg

Discussion • Share is about 3.9% - Absolute numbers up to 574,000 servers • Proper information leakage present with up to 158,000 servers • No implementation problem but rather a configuration problem • Number of potentially usable leaking DNS servers highest in the USA DIMVA 2019, Gothenburg

Conclusion • Observed that misconfigured DNS servers might leak internal information to external intruders without the need for an exploit or vulnerability (configuration issue) • Almost 4% of the DNS servers might leak such information • Not a major Internet security problem, but the absolute numbers should be reduced • Data at https://github.com/RUB-SysSec/InfraLeakingDNS DIMVA 2019, Gothenburg

Questions? Conclusion Dennis Tatang • Observed that misconfigured DNS servers dennis.tatang@rub.de might leak internal information to external intruders without the need for an exploit or @dennis4its on Twitter vulnerability (configuration issue) • Almost 4% of the DNS servers might leak such information • Not a major Internet security problem, but the absolute numbers should be reduced • Data at https://github.com/RUB- SysSec/InfraLeakingDNS DIMVA 2019, Gothenburg