Transcript slides
A CSCE 548 presentation: Trusting Network Name Resolution By:- Ajay Kumar Koduri Source:- 24 deadly sins of software security programming flaws and how to fix them. By; Michael Howard, David LeBlanc, John Viega CONTENTS • Overview of the problem. • Spotting the sin pattern. • Spotting the sin during code review. • Redemption steps. • References and other resources. • Conclusion. OVERVIEW OF THE PROBLEM • What is Name Resolution? DNS or WINS (Windows Internet Name Service) are used for name resolution. • Possible types of attacks. • The sin in detail OVERVIEW OF THE PROBLEM Source:- http://computer.howstuffworks.com/dns.htm OVERVIEW OF THE PROBLEM Source:http://www.windowsecurity.com/articlestutorials/authentication_and_encryption/Unders tanding-Man-in-the-Middle-Attacks-ARP-Part2.html SPOTTING THE SIN PATTERN • This sin applies to any application that behaves as a client or server on a network. • Check if your browser is standard or not. (i) Standard browsers provide most low-level security. (ii) If it is not a standard browser SSL/TLS checks must be performed in the code. • SSL can be used to authenticate the client to the server. SPOTTING THE SIN DURING CODE REVIEW • There’s no security checklist to check off because the defects are built into the architecture of the application. Unlike other sins, this sin of trusting name resolution is completely independent of the programming language you use. The infrastructure relied on is the problem. • Checking which network protocol is used for communications . Avoiding UDP as a transport as it is more vulnerable than TCP. TESTING TECHNIQUES TO FIND THE SIN • Build an evil client and evil server • Approach: create a way to proxy the information between the client and server. • Checking by attacker-controlled server. REDEMPTION STEPS • Ensure the connections are running over SSL and the code is performing all the appropriate PKI (Public Key Infrastructure). • Use IPSec (Internet Protocol Security). • Use public key cryptography. • Mapping DNS names to IP addresses using a “hosts file” (easiest way). MORE REDEMPTION STEPS • Not to trust DNS information as its not reliable. • Specifying IP Sec for the systems on which your application will run on. CONCLUSION This problem if overlooked can harm the client severly. So, using the redemption steps mentioned to mitigate the possible vulnerabilities is a good practice especially if high security is desired. REFERENCES AND OTHER RESOURCES • Building Internet Firewalls, Second Edition by Elizabeth D. Zwicky, Simon Cooper, and D. Brent Chapman (O’Reilly, 2000). • 24 Deadly Sins of Software Security: Programming Flaws and How to Fix Them. By; Michael Howard, David LeBlanc, John Viega. • Threat Analysis of the Domain Name System (DNS) RFC 3833: www.rfcarchive.org/getrfc.php?rfc=3833 • DNS Security Extensions: www.dnssec.net/ • DNSSEC Deployment Initiative: www.dnssec-deployment.org/ • OzEmail: http://members.ozemail.com.au/~987654321/ impact_of_rfc_on_dns_spoofing.pdf