Large-Scale Analysis of Infrastructure-Leaking DNS Servers

Proactive threat detection : a DNS based approach

“…In their paper, they consider the privacy of mobile users, by minimizing client information in DHCP messages, at least until the network has been authenticated. Finally, while the already discussed work by Tatang et al [208] did find patterns in the DNS that likely resulted from DHCP carry-over, the authors appear to not have considered the role of DHCP.…”

“…The reverse side of DNS is less frequently studied. Tatang et al [208] studied privacy leaks in rDNS to a certain extent, after observing that some misconfigured name servers provide outsiders with answers to PTR queries for private IP addresses (e.g., RFC 1918 [209]), if such addresses are used inside the networks of the misconfigured servers. They characterized the country and network distribution of such servers, and studied privacy-sensitive patterns in hostnames, revealing end-user devices as well as security-critical infrastructure such as firewalls.…”