dns 安全防护新技术
DNS安全防护新技术,Guo Qing,议程,DNS四大威胁 DNS 安全架构 DNS 5.19案例 DNS专业防护,DNS 四大威胁,DNS DDOS Flood attack DNS amplification attacks DNS毒化 Cache劫持 重定向 DNS 异常查询 Malformed Query DNS溢出 - ATLAS 零日漏洞 内网蠕虫,DNS遭受攻击的一些特征,Almost lost internet connections: www, email, 几乎无法上网 或上网速度很慢， Very low internet connections， 互联网用户得不到本地DNS回应 DNS servers: CPU/Memory 几乎 100% Layer-4 switches, the same, plus abnormally high parallel session amount, Source IP address of the incoming traffic: widely scattered. ,DNS服务宕机，DDOS？,DNS故障导致后果,授权DNS,服务宕机,被攻击 自身故障,攻击防护 定期自查,解决方案,网络拥塞,重定向 数据重传,默认应答 控制DNS缓存递归,解决方案,DNS请求数据,用户入网接入,接入中断,无法解析 上网缓慢,更改DNS指向有效DNS,解决方案,著名网站监控,流量下降,访问减少 用户数少,通报电信 通知客户,解决方案,DNS Response DDoS 5.19,Pattern: x81x82x00x01x00x00x00x00x00x00x04tockx04usnox04navyx03milx00x00x01x00x01,4) If the spoofed replies have right TXID, update cache with: dummy1.sun.com = java.sun.com java.sun.com = 7.7.7.7,Cache poisoning attack,Attacker,Local DNS,2) Check cache for: dummy1.sun.com = No Do we have name server entry for sun.com? = Yes,3) Lets ask ns1.sun.com,ns1.sun.com Server,1) Attacker sends a request for dummy1.sun.com,议程,DNS四大威胁 DNS 安全架构 DNS 5.19案例 DNS专业防护,DNS安全架构与应对,架构层面 Anycast 网络层面 清洗中心 Anti-DDOS 入侵防护 Anti-Intrusion 内网感染Anti-Botnet 应用层面 授权DNS补丁 劫持毒化 Cache Malformed Query,DNS安全加固防护 清洗 vs.IPS,云火墙 IPS/IDS,DNS 服务加固,Internet,云清洗 Peakflow SP CP/TMS,Sensor Base威胁数据库,防火墙,1.Anti-DDOS,3. Anti-Botnet,Peakflow/X,Peakflow SP CP/TMS,云火墙 IPS 实现,2.Anti-Intrustion,Peakflow/X,Peakflow CP,CP/TMS : DNS 服务的安全防护 旁路 vs. 串接,Protection DNS Field Regex Countermeasure DNS Anti-Spoofing Countermeasure DNS Rate Limiting Countermeasure DNS Cache Poison Detection and Countermeasure,Peakflow SP TMS,DNS Servers,Peakflow SP TMS,Visibility and Detection Track Top DNS Objects per Mitigation Provide more context during attacks DNS Request Type Report Provide more visibility into DNS request traffic Report the following DNS request types A, AAAA, NS, CNAME, SOA, PTR, MX, TXT,DNS Servers,Port Span,Peakflow SP TMS,Peakflow SP TMS,Secure DNS servers and infrastructure from major attacks,IPS Correlation DNS Signature,3708.0 - AnalogX Proxy Socks4a DNS Overflow 4602.0-4 - Beagle (Bagle) Virus DNS Lookup 4615.0-3 - Beagle.B (Bagle.B) Virus DNS Lookup 4620.0 - DNS Limited Broadcast Query 5537.0 - ICQ Client DNS Request 5538.0 - AIM Client DNS request 5539.0 - Yahoo Messenger Client DNS Request 5540.0 - MSN Messenger Client DNS Request 5493.0 - Llsrpc Bind 5766.0 - DNS Resolution Response Code Execution 5858.0-4 - DNS Server RPC Interface Buffer Overflow 6013.0-1 - IRCBOT_JK DNS Lookup 6050.0-1 - DNS HINFO Request 6064.0 - BIND Large OPT Record DoS 6013.0-1 - IRCBOT_JK DNS Lookup 6050.0-1 - DNS HINFO Request,6051.0-1 - DNS Zone Transfer 6052.0-1 - DNS Zone Transfer from High Port 6053.0-1 - DNS Request for All Records 6054.0-1 - DNS Version Request 6055.0-2 - DNS Inverse Query Buffer Overflow 6056.0-2 - DNS NXT Buffer Overflow 6057.0-2 - DNS SIG Buffer Overflow 6058.0-1 - DNS SRV DoS 6059.0-2 - DNS TSIG Overflow 6060.0-3 - DNS Complain Overflow 6061.0-1 - DNS Infoleak 6062.0-1 - DNS Authors Request 6063.0-1 - DNS Incremental Zone Transfer 6064.0 - BIND Large OPT Record DoS 6065.0 - DNS Query Name Loop DoS 6066.0 - DNS Tunneling 6067.0 - DNS TSIG Bugtraq Overflow,Regional Fingerprint Server,云指纹共享策略，Regional In-Cloud Fingerprint Sharing,主要功能： 运营商内部“云”计划共享策略，省网或地市网络CP设备可与Fingerprint服务器进行通信，获得网络内部的安全威胁数据信息。,功能优势： 用户可上传或下载网络安全威胁特征 CP设备间可共享特征库信息，资源共享 对新型攻击（New Attacks)或第零日攻击(Zero-day Attacks)具有预见性和防范措施 构成运营商内部安全联盟，节省投资 有利于为大型企业用户（例如，银行）提供流量清洗服务,部署在骨干网络,省/城域网监测系统,省/城域网监测系统,省/城域网监测系统,议程,DNS四大威胁 DNS 安全架构 DNS 5.19案例 DNS专业防护,DNS Attacks - When & What?,OCT 2002,JUN 2004,OCT 2004,JAN-FEB 2006,NOV 2004,NOV 2002,FEB 2007,Root Server Attacked Duration:1 hour Multi-modal: smurf, ICMP, port 53 “7” Root Servers appear unreachable Impact: No noticeable user effect,UltraDNS TLD Servers Attacked Duration: 24 hours + ICMP 0,8 and then port Easily filtered - uses pure volume of packets to disable Results in 2-way traffic load Impact: No noticeable user effect,Akamai attacked Duration: 4 hours No mitigation possible Port 53, UDP, valid queries Multi-millions queries per second Impact: Global Impact,DDoS for hire (extortion) The golden age for worms/trojans The perfect DNS DDoS in the wild No protocol based defense or mitigation Attack on Bandwidth, not applications or servers - 11 Gbps+ Impact: Significant collateral damage,January-February .com, .net (Verisign), .org (UltraDNS) Utilized open recursive servers Average attack 7-10 Gbps TLD Operators have no successful defense Impact: Considerable user impact,G, L & M Root Servers, Other TLDs (UltraDNS)? Utilized large bogus DNS UDP queries from many bots Aggregate attacks 10 Gbps+ Mitigate: Special Hardware Impact: 90% Traffic dropped localized user impact,NOV 2006,UUNet Attack - 2nd Level DNS UDP/53, auth servers for bank.foo Spoofed source IPs - 800 Kpps Impact: End-user/customer Mitigated with C
