Internet Initiative Japan Inc. · TSE:3774
Internet Initiative Japan — Internet Systems Consortium — Technical Presentation (October 2011)
66 slides from Internet Initiative Japan's technical presentation, Oct 12, 2011
Slide 1: DNS Response Policy Zone (DNSRPZ)
The image cannot be displayed. Your computer may not have enough memory to open the image, or the image may have been corrupted. Restart your computer, and then open the file again. If the red x still appears, you may have to delete the image and then insert it again. DNS Response Policy Zone (DNSRP
Slide 2: Logistics
Logistics • This presentation can be downloaded from the Webinar recording and from ISC’s Knowledge Base: http://deepthought.isc.org • ISC updates, presentations, and materials can be followed on: Facebook - http://www.facebook.com/InternetSystemsConsortium Twitter - ISCdotORG Linkedin - http:
Slide 3: Our Goal – Take Back DNS
Our Goal – Take Back DNS DNS works as well for the bad guys (criminals, spammers, spies) as for respectable citizens. The bad guys are taking better advantage of DNS's resiliency and distributed autonomy. Something has got to be done! ISC is acting: Act I – Massive Passive DNS Deployment Act II - DN
Slide 4: Agenda
Agenda • The DNSRPZ Quick Talk • Why do we need DNSRPZ? • More Details • DNSRPZ Providers
Slide 5: Gratitude
Gratitude • Paul Vixie and Vernon Schryver for all the heavy lifting to make DNSRPZ happen. • ISC’s BIND Engineering Team – for integrating this new feature so quickly. • Eric Ziegast - my partner in explaining DNSRPZ to people. • For the new DNSRPZ Providers: Simon Forster [email protected] A
Slide 6: DNSRPZ Quick Talk
DNSRPZ Quick Talk y
Slide 7: DNS Response Policy Zone (DNS RPZ)
DNS Response Policy Zone (DNS RPZ) • DNS RPZ is policy information inside a specially constructed DNS zone. • This enables DNS reputation data producers and consumers to cooperate in the application of such policy to real time DNS responses. • DNS RPZ turns the recursive DNS server into a security h
Slide 8: Core DNS Principles
Core DNS Principles .root .org Master/ Who is in charge of isc.org? Primary DNS isc.org sie.isc.org AXFR TSIG TSIG IXFR www.isc.org is 149.20.64.42 Caching Resolver Slave/ Secondary DNS DNS What is the IP for www.isc.org? AXFR - Full Zone Transfers IXFR - Incremental Zone Transfers TSIG - Transactio
Slide 9: DNS RPZ
DNS RPZ .root Security Company .org Master DNS Who is in charge of isc.org? RPZ isc.org AXF R sie.isc.org IXFR RPZ www.isc.org is 149.20.64.42 Caching Resolver DNS RPZ capability on the DNS Cashing Resolver allows zone transfers to What is the IP for www.isc.org? be pushed out in seconds.
Slide 10: DNS RPZ in Action
DNS RPZ in Action Intel to find Security Company the badness xyzbadness.com Master DNS RPZ AXF R IXFR RPZ Caching Resolver DNS What is the IP for xyzbadness.com? What is the IP for xyzbadness.com? SPAM Computer looks up Xyzbadness. com
Slide 11: How is DNSRPZ Different?
How is DNSRPZ Different? Security Company Master DNS DNS RPZ RBL Push Once AXFR IXFR Some Security RPZ Device Query Every Caching Domain Resolver DNS
Slide 12: Demo - before
Demo - before work home center Join The Work-At-Home Revolution Workhomecenter refox Box Edit View History Bookmarks Tools Help GS ~ D> ~ S J [Li heto:s1om.sorkhomecenter.com! , 7 workhomecenter > Join The Work-At-Home Revolution Member Login Employer Login United States Canada —_ United Kingdom Wor
Slide 13: Demo - after
Demo - after Problem loading page = @) wy te) |) { http://www.malware-infected.com/ Pv ) Google Q) Problem loading page 7 1 Server not found Firefox can't find the server at www.malware-infected.com. Check the address for typing errors such as ww.example.com instead of www.example.com If you are una
Slide 14: What it looks like
What it looks like ann e Terminal — sh — 106x22 zl:~ root# cat /etc/resoly.conf a nameserver 264.152.187.111 zli~ root# dig www.malware-infected.com a ‘ 3 <o> DIG 9.6.8-APPLE-P2 <c> www.malware-infected.com a 33 global options: +cmd 3; Got answer: 33 ->eHEADER<<- opcode: QUERY, stat NXDOMAIN, ii: 82
Slide 15: How is DNSRPZ Different?
How is DNSRPZ Different? Security • DNSRPZ allows for Company 1 multiple providers – building a richer list of Security “bad actors” Company 2 • Allows for industry incident feeds. RPZ • Allows for local incident OPSEC AXFR Caching management feeds. Incident IXFR Resolver DNS INFOSEC or Security Tea
Slide 16: Possible DNS RPZ Uses
Possible DNS RPZ Uses • Block or redirect malicious drop sites (DNS used by URLs) • Block ability of C&C to find its way back using DNS • Walled garden notification for infected clients • Services that use PTR lookups (IP reputation can map into here).
Slide 17: Possible Uses Examples
Possible Uses Examples • Enterprise networks can us it to stop infections – and let NOC know something is wrong. • Hosting Provider can use it to block infected customer host – and let NOC know something is wrong. • Service Providers – can use it to protect customers AND notify customer AND let the
Slide 18: DNSRPZ Getting the Word out
DNSRPZ Getting the Word out • There was a healthy amount of pre-announced to operational security community to build a ecosystem. • With BIND 9.8.1, we have a solid version for operators and networks to migrate and try DNSRPZ. • ISC’s role is to now get the word out. The next wave of deployments wou
Slide 19: ISC's Role with DNS RPZ
ISC’s Role with DNS RPZ • ISC has three roles with DNS RPZ as a new “hammer” in our security toolkit: Code and Functionality in BIND & working with all DNS Recursive Resolver Software Vendors to insure everyone is adopting the same formats. Work with all potential Black List Providers. Work wi
Slide 20: Pause for Questions
Pause for Questions
Slide 21: Links while you are thinking …
Links while you are thinking … • Discussion List • https://lists.isc.org/mailman/listinfo/dnsrpz-interest • Taking back the DNS, Paul Vixie, 29th July 2010 • http://www.isc.org/community/blog/201007/taking- back-dns-0 • Google “taking back the dns” • Draft Specification • ftp://ftp.isc.org/isc/dnsrp
Slide 22: Why We Need DNSRPZ?
Why We Need DNSRPZ?
Slide 23: Components of the Criminal Cloud
Components of the Criminal Cloud Payment SPAM Processors BOTNET Drive-By Secondary Controller Proxy Malware Mule Operations Avalanche: SPAM Cloud that you Name can lease time Servers Zeus: IPv6 Compliant “Build your Own Criminal Cloud. BOT BlackHole: Metasploit Cloud you Herder can lease Malware
Slide 24: Stage Domain Name
Stage Domain Name SPAM BOTNET Drive-By Secondary Controller Proxy Malware Get Name Domain Servers Stag e Do BOT ma i n Stage on NS Herder or FF NS Malware Victim of Crime TLD Domain Packer
Slide 25: Prepare Drive-By
Prepare Drive-By Send Malware SPAM BOTNET Drive-By Secondary Controller Proxy Malware Load Name Malware Servers Hacker Malware Victim of Crime TLD Domain Packer
Slide 26: Social Engineered SPAM to Get People to Click
Social Engineered SPAM to Get People to Click (Spear Phishing) Send SPAM SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Click on Servers me now Hacker Malware Victim of Crime TLD Domain Packer
Slide 27: Drive-By Violation
Drive-By Violation Click on me now SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Servers Hacker Malware Victim of Crime TLD Domain Packer
Slide 28: Drive-By Violation
Drive-By Violation SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Servers Hacker Owned! Malware Victim of Crime TLD Domain Packer
Slide 29: Poison Anti-Virus Updates
Poison Anti-Virus Updates SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Servers Poison the anti-virus updates Hacker All updates to 127.0.0.1 Anti-Virus Malware Vendor Victim of Crime TLD Domain Packer
Slide 30: Prepare Violated Computer
Prepare Violated Computer SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Servers Call to secondary Malware site Hacker Load secondary package Malware Anti-Virus Vendor Victim of Crime TLD Domain Packer
Slide 31: Call Home
Call Home SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Servers Call to Controller Report: Operating System Hacker Anti-Virus Location on the Net Malware Software Patch Level Victim of Crime Bandwidth TLD Capacity of the computer Domain Packer
Slide 32: Load Custom Malware
Load Custom Malware SPAM Drive-By Secondary Controller Proxy Malware BOTNET Name Go get New Servers Module Hacker Malware TLD Victim of Crime Domain Packer
Slide 33: Start Worming, Scanning, & Spreading
Start Worming, Scanning, & Spreading SPAM Drive-By Secondary Controller Proxy Malware BOTNET Name Servers BOTNET Herder Malware IPv6 IPv6 Victims of Crime TLD Packer Domain
Slide 34: The Domain names were Black Listed!
The Domain names were Black We know the SPAMListed! addresses We can see this guy’s SPAM Drive-By Secondary Controller DNS BOTNET Proxy Malware Activity! We knew the infrastructure We we knew addresses! the controller Name addresses! Servers BOT We knew the NS Herder used for the We knew Malware cri
Slide 35: DNS RPZ would have stopped this attack!
DNS RPZ would have stopped this attack! Send SPAM SPAM BOTNET Drive-By Secondary Controller Proxy Malware Name Servers Blacklisted with DNSRPZ Hacker Malware Victim of Crime NOC TLD Alert! Domain Packer
Slide 36: We need to look “out of the Box”
We need to look “out of the Box” • Put things in context – this illustrate was real. The computer was up to date with all the patches. The anti-virus was up to date. The users getting hit with MEBROOT/Torpig were all using Firefox and Noscipt Some of the users were security people. The net
Slide 37: Pause for Questions
Pause for Questions
Slide 38: During the Questions …..
During the Questions ….. • How do you get support for DNSRPZ? • Today, that is with BIND: Public Benefit support through the community: https://lists.isc.org/mailman/listinfo/dnsrpz-interest Public Benefit support through the ISC Knowledge Base: http://deepthought.isc.org BIND Software Support
Slide 39: DNSRPZ More Details
DNSRPZ More Details
Slide 40: Original Problem Statement
Original Problem Statement • DNS is a decentralized system offering complete distributed autonomy. The relationships between operators and content owners are both tenuous and resilient. • The split registry/registrar/registrant model insulates all parties from responsibility, so the global DNS lacks
Slide 41: Historical Context
Historical Context • DNS is not unique in its unaccountability. Most Internet systems (mail, blogs, I-M) are similar. • In e-mail it's extremely common to subscribe to an DNSBL (realtime blackhole list) in order to reject messages from known-bad sources. • Features similar to DNSBL exist for DNS in
Slide 42: DNS IND (&T)
DNS IND (&T) IETF DNSIND working group (mid 1990's): (I)ncremental zone transfer – RFC 1995 (N)otification of zone changes – RFC 1996 (D)ynamic update of zone content – RFC 2136 (T)ransaction signatures (TSIG) – RFC 2845 Pre-IND DNS zone changes had long latency, heavy bandwidth, and low
Slide 43: RPZ History
RPZ History • RPZ 1.0 released as patches to BIND9 in 2010: • Rule-based system, triggered on query name/ type • Rule-forced outcomes: Return a fake alias (CNAME), for walled gardens Return a fake NXDOMAIN, to blackout the name Return a fake answer of the type being queried Protect the name
Slide 44: DNS RPZ
DNS RPZ .root Security Company .org Master DNS Who is in charge of isc.org? RPZ isc.org AXF R sie.isc.org IXFR RPZ www.isc.org is 149.20.64.42 Caching Resolver DNS RPZ capability on the DNS Cashing Resolver allows zone transfers to What is the IP for www.isc.org? be pushed out in seconds.
Slide 45: RPZ Content Examples (1)
RPZ Content Examples (1) • If rpz.net is a response policy zone and example.com is a name to be blacked out: example.com.rpz.net CNAME . • If all subdomains of example.com are to be aliased to a local walled garden: *.example.com.rpz.net CNAME wg.isc.org • If www.example.com/A should be redirected:
Slide 46: RPZ Content Examples (2)
RPZ Content Examples (2) • If www.partner.com is to be protected from any policy action by any subsequent RPZ: www.partner.com.rpz.net CNAME www.partner.com • If www.example.com is to appear to be empty: www.example.com.rpz.net CNAME *. • If a A RRs in 192.168.1.0/24 are to be replaced with a local
Slide 47: RPZ Content Examples (3)
RPZ Content Examples (3) • If AAAA RR's in 2001:500:2f::/48 ought to cause fake NXDOMAIN responses, except 2001:500:2f::f which is to be returned as normal: 128.f.zz.2f.500.2001.rpz-ip.rpz.net CNAME *. 48.zz.2f.500.2001.rpz-ip.rpz.net CNAME . • Note: “zz” in this context means “::”.
Slide 48: Lessons Learned From RPZ 1.0
Lessons Learned From RPZ 1.0 • Sometimes the trigger has to be answer-based E.g., if the A or AAAA RR is within a CIDR block E.g., if the NS name or address is poisoned • Sometimes the subscriber wants to import the triggers but locally specify the policy outcome E.g., import a list of bad nam
Slide 49: RPZ Data as DNS Control
RPZ Data as DNS Control DNS data maps <owner,type> record-set RPZ data overloads <owner,type> as a trigger and record-set as an action A hybrid recursive/authoritative name server which subscribes to one or more RPZs can answer untruthfully according to RPZ policy RPZ data plane is promoted
Slide 50: RPZ Format 1 (in 2010)
RPZ Format 1 (in 2010) Triggers: Actions: Q-name (all types) Exemption Q-name, Q-type Force NXDOMAIN Force empty answer Force CNAME answer Force specific answer
Slide 51: RPZ Format 2 (in 2011)
RPZ Format 2 (in 2011) New Triggers: New Actions: Answer in netblock None Name server name Name server address in netblock
Slide 52: Subscriber Configuration in BIND9
Subscriber Configuration in BIND9 options { // other stuff response-policy { zone "dns-policy1.vix.com"; zone "dns-policy2.vix.com" policy given; zone "dns-policy3.vix.com" policy NO-OP; zone "dns-policy4.vix.com" policy NXDOMAIN; zone "dns-policy5.vix.com" policy NODATA; zone "dns-policy6.vix.com"
Slide 53: Producer/Consumer Model in RPZ
Producer/Consumer Model in RPZ • Producers can use RFC 2136 “UPDATE” to maintain their zone, or just periodically regenerate it and use “ixfr-from-differences” to tell BIND to compute deltas. • Producers will use IXFR for efficient zone delta transmission, and TSIG for protection of RPZ data and aut
Slide 54: Possible Good
Possible Good • Specialization of labor: security experts can produce robust and targeted patterns for use by customer DNS recursive name servers. • Competition: many security experts, many name server implementers (not just BIND!), and a global market of potential customers. • Effect on crime: a do
Slide 55: Possible Harm
Possible Harm • Governments could use RPZ to enforce laws about censorship, since it is an open standard. • Some RPZ data sources will inevitably be politically, racially, or religiously motivated (“all Christian web sites” or “all Muslim web sites”). • As with all reputation systems, the systemic e
Slide 56: Pause for Questions
Pause for Questions
Slide 57: During the Questions …..
During the Questions ….. • Download & save for later reading the Protect IP Paper: • Security and Other Technical Concerns Raised by the DNS Filtering Requirements in the Protect IP Bill. http://infojustice.org/archives/3469 • Security Week Article: http://www.securityweek.com/
Slide 58: DNSRPZ Providers
DNSRPZ Providers y
Slide 59: Spamhaus' DBL as RPZ
Spamhaus' DBL as RPZ >» Domains seen in spam or under control of spammers >» Includes malware domains >» Published at rpz.spamhaus.org >» Email [email protected] for access >» More info at http://www.spamhaus.org/news.lasso?article=669
Slide 60: ActiveTrust® Resolver RPZ
ActiveTrust® Resolver RPZ • Focused on enterprise threats Malware distribution and communications Phishing, including spear-phishing Data exfiltration • Constantly updated with fresh information Market-leading detection of phishing and malware sites Criminal infrastructure analysis using p
Slide 61: DNS RPZ & SURBL
DNS RPZ & SURBL • What is SURBL RPZ? SURBL RPZ is a version of SURBL's high-‐quality an>-‐spam, an>-‐phishing and an> malware data in the form of a DNS Response Policy Zone (DNS RPZ). DNS RPZs are used to deny or modify the resolu>on of low-‐ reputa>on domains, in other words, to deny DNS servi
Slide 62: Questions? [email protected]
Questions? [email protected]
Slide 63: Don’t get Caught Off Guard with Old BIND!
Don’t get Caught Off Guard with Old BIND! • Get Professional Support to help you upgrade BIND! http://www.isc.org/getbindsupport • Special Offer Software Support & Consulting Deal! Take advantage of this special deal that combines 6 months of Basic Support & 8 hours of Expert Consulting to get y
Slide 64: ISC In a Nutshell
ISC In a Nutshell Forum Professional Services Public Benefit Services • BIND • Consulting • DNS “F-ROOT” • BIND 10 Working Group • Training • DNS Secondary Server • DHCP • Software Support Services Resiliency (SNS) PB • AFTR/PCP • Custom Software Development • Hosted@ - hosting a range of open sourc
Slide 65: New from ISC
New from ISC ++ & =sea@sc Security Trust Information
Slide 66: ISC
ISC Technology Leadership for the Common Good
Internet Systems Consortium — Technical Presentation (October 2011) on 6ix