Everything in its right place: Improving DNS resilience

Abstract

In 2023, the Domain Name System (DNS) will celebrate 40 years since its creation. Despite the passing of four decades, the DNS continues to play a fundamental role in today's Internet. Specifically, the DNS provides the essential service of translating human-readable domain names (e.g., example.org) to IP addresses (e.g., 93.184.216.34).Over the years, the Internet has become increasingly vital to our modern society. The continuous flow of information that takes place on the Internet every day cannot be stopped without catastrophic consequences. In addition, services of crucial importance for people's everyday lives, such as government services, are increasingly transitioning to digital infrastructure. Given the importance of the DNS for the functioning of the Internet and modern society, any issues that the DNS encounters nowadays would have far-reaching consequences. However, over the past 40 years, weaknesses in the DNS system have emerged. One of the most significant cybersecurity threats facing the DNS today are Distributed Denial of Service (DDoS) attacks, which can have a severe impact on the availability of the DNS ecosystem. Recent events show that targeted attacks on even a small portion of the DNS infrastructure can impact millions of services and users.In this scenario, a comprehensive characterization of the resilience mechanisms of the DNS authoritative infrastructure, along with an analysis of threats against this resilience, is missing. This gap has led us to the main goal and contribution of this thesis. To achieve this goal, we use a mixed measurement and analytical approach, which has focused on different detractors of DNS resilience. Specifically, throughout the course of this thesis, we analyze misconfigurations and vulnerabilities resulting from miscommunication between operators, assess the choices made by these operators in creating more robust and stable deployments in the face of existing best practices, and evaluate the effectiveness of the deployed techniques in overcoming DDoS attacks.Focusing on our contributions, we show that while the distributed nature of the DNS has enabled its scalability and success, it also presents risks to its resilience. Inconsistency in the DNS hierarchy resulting from miscommunications between stakeholders increases the attack surface and affects resilience, enabling lame delegations and hijacking with potentially severe consequences. SommarioIl 2023 segna il quarantenario dalla creazione del Sistema di Risoluzione Nomi a Dominio, conosciuto come DNS. Nel corso del tempo, il DNS ha sempre svolto un ruolo fondamentale nell'ecosistema di Internet: possiamo considerarlo come un elenco telefonico, in quanto il DNS traduce nomi di dominio facili da ricordare in indirizzi IP (similarmente alle nostre pagine gialle per i numeri di telefono). Negli anni, Internet ha assunto sempre più importanza e i suoi quarant'anni iniziano a pesare sul DNS. Ogni giorno, infatti, assistiamo ad un flusso costante di informazioni che scorrono sulle autostrade digitali e che non p...