Identifying and Analyzing Broadband Internet Reverse DNS Names

Lee, Youndo; Spring, Neil

doi:10.1145/3143361.3143392

Cited by 8 publications

(3 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The aforementioned works focus mostly on core infrastructure such as routers. Lee et al [14] instead shift focus to end-users, i.e., customers of Internet Service Providers (ISPs).…”

Section: Related Workmentioning

confidence: 99%

Saving Brian's Privacy: the Perils of Privacy Exposure through Reverse DNS

Toorn¹,

Sommese²,

Sperotto³

et al. 2022

Preprint

View full text Add to dashboard Cite

Given the importance of privacy, many Internet protocols are nowadays designed with privacy in mind (e.g., using TLS for confidentiality). Foreseeing all privacy issues at the time of protocol design, however, is challenging and may become near impossible when interaction out of protocol bounds occurs.One demonstrably not well understood interaction occurs when DHCP exchanges are accompanied by automated changes to the global DNS, for example to dynamically add hostnames for allocated IP addresses. As we will substantiate in this paper, this is a privacy risk: the presence of specific clients and network dynamics may be learned from virtually anywhere on the Internet, even if other mechanisms to limit tracking by outsiders (e.g., blocking pings) are in place.We present a first of its kind study into this risk. We identify networks that expose client identifiers in reverse DNS records and study the relation between the presence of clients and said records. Our results show a strong link: in 9 out of 10 cases, records linger for at most an hour, for a selection of academic, enterprise and ISP networks alike. We also demonstrate how client patterns and network dynamics can be learned, by tracking devices owned by persons named Brian over time, revealing shifts in work patterns caused by COVID-19 related work-from-home measures, and by determining a good time to stage a heist.

show abstract

“…The aforementioned works focus mostly on core infrastructure such as routers. Lee et al [14] instead shift focus to end-users, i.e., customers of Internet Service Providers (ISPs).…”

Section: Related Workmentioning

confidence: 99%

Saving Brian's Privacy: the Perils of Privacy Exposure through Reverse DNS

Toorn¹,

Sommese²,

Sperotto³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Existing enterprise network security appliances such as border firewalls and intrusion detection systems do not provide fine-grained visibility of internal DNS-related hosts and assets, creating significant "blind spots" for the IT department [15]. While there is a significant body of existing academic research on DNS traffic analysis and DNS security, existing works either focus on forensic analysis of logs collected from DNS servers, such as recursive resolvers on the Internet [35], [7], [25], [11] and domain registrars [27], or concentrate on packetlevel domain names [32], [3], [4], [42]. Our prior work in [34] is among the few to analyze DNS traffic in enterprise networks with a view to identifying and monitoring DNS assets to facilitate better security management.…”

Section: Introductionmentioning

confidence: 99%

Analyzing Enterprise DNS Traffic to Classify Assets and Track Cyber-Health

Lyu,

Gharakheili,

Russell

et al. 2022

Preprint

View full text Add to dashboard Cite

The Domain Name System (DNS) is a critical service that enables domain names to be converted to IP addresses (or vice versa); consequently, it is generally permitted through enterprise security systems (e.g., firewalls) with little restriction. This has exposed organizational networks to DDoS, exfiltration, and reflection attacks, inflicting significant financial and reputational damage. Large organizations with loosely federated IT departments (e.g., Universities and Research Institutes) often do not even fully aware of all their DNS assets and vulnerabilities, let alone the attack surface they expose to the outside world.In this paper, we address the "DNS blind spot" by developing methods to passively analyze live DNS traffic, identify organizational DNS assets, and monitor their health on a continuous basis. Our contributions are threefold. First, we perform a comprehensive analysis of all DNS traffic in two large organizations (a University Campus and a Government Research Institute) for over a month, and identify key behavioral profiles for various asset types such as recursive resolvers, authoritative name servers, and mixed DNS servers. Second, we develop an unsupervised clustering method that classifies enterprise DNS assets using the behavioral attributes identified, and demonstrate that our method successfully classifies over 100 DNS assets across the two organizations. Third, our method continuously tracks various health metrics across the organizational DNS assets and identifies several instances of improper configuration, data exfiltration, DDoS, and reflection attacks. We believe the passive analysis methods in this paper can help enterprises monitor organizational DNS health in an automated and risk-free manner.

show abstract

“…The aforementioned works focus mostly on core infrastructure such as routers. Lee et al [200] instead shift focus to end-users, i.e., customers of Internet Service Providers (ISPs). In their paper, they study means to infer the connection types of hosts in access networks.…”

Section: Information In Hostnamesmentioning

confidence: 99%

Proactive threat detection : a DNS based approach

Toorn¹

View full text Add to dashboard Cite

Peter and Anneke, I'd like to thank you personally for allowing me to figure-out my own path in life. You have always supported me in every choice I made, regardless of the direction it would take me. And you were there when I needed you. Thank you.Finally, and certainly not last. Lien, you are truly special to me. Even when my Ph.D. work, Storro work, the combination thereof, or life in general, got me stressed and moody you stood by my side. You were there when I needed you, or offered me some 'Twentse nuchterheid' to get me back on the rails.

show abstract

Identifying and Analyzing Broadband Internet Reverse DNS Names

Cited by 8 publications

References 21 publications

Saving Brian's Privacy: the Perils of Privacy Exposure through Reverse DNS

Saving Brian's Privacy: the Perils of Privacy Exposure through Reverse DNS

Analyzing Enterprise DNS Traffic to Classify Assets and Track Cyber-Health

Proactive threat detection : a DNS based approach

Contact Info

Product

Resources

About