TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records

Toorn, Olivier van der; Rijswijk-Deij, Roland van; Fiebig, Tobias; Lindorfer, Martina; Sperotto, Anna

doi:10.1109/eurospw51379.2020.00080

Cited by 8 publications

(8 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It can be seen as the Internet's phonebook as it allows, among others, domain names to be resolved to IP addresses. Domain name operators can publish various types of resource records (RR) in the DNS zone of their domain, for example A records (IP addresses), MX records (mail exchanger for inbound e-mail), and TXT records, which are 'freetext' of variable length and are used for a variety of purposes [7]. Records are held by the name server that is authoritative for a given domain name.…”

Section: A Dnsmentioning

confidence: 99%

“…We selected the domains from the re-ranked top 100 for this case-study as their reduction, when moving to TXT queries, was only 32%. In the past, by matching each TXT record against a regular expression, we were able to categorize roughly 99% of all TXT records in OpenINTEL [7]. This technique quickly shows what kind of records are present for a given population.…”

Section: Categorization Of Txt Recordsmentioning

confidence: 99%

“…We perform this analysis to shed light on the TXT records responsible for the small reduction in size. Table II [7] for details. Compared to the numbers for the whole population of OpenINTEL on 2018-12-31, the 'Email' category dropped significantly, 4% from 69%.…”

Section: Categorization Of Txt Recordsmentioning

confidence: 99%

See 2 more Smart Citations

ANYway: Measuring the Amplification DDoS Potential of Domains

Toorn

Krupp

Jonker

et al. 2021

2021 17th International Conference on Network and Service Management (CNSM)

Self Cite

View full text Add to dashboard Cite

DDoS attacks threaten Internet security and stability, with attacks reaching the Tbps range. A popular approach involves DNS-based reflection and amplification, a type of attack in which a domain name, known to return a large answer, is queried using spoofed requests. Do the chosen names offer the largest amplification, however, or have we yet to see the full amplification potential? And while operational countermeasures are proposed, chiefly limiting responses to 'ANY' queries, up to what point will these countermeasures be effective?In this paper we make three main contributions. First, we propose and validate a scalable method to estimate the amplification potential of a domain name, based on the expected ANY response size. Second, we create estimates for hundreds of millions of domain names and rank them by their amplification potential. By comparing the overall ranking to the set of domains observed in actual attacks in honeypot data, we show whether attackers are using the most-potent domains for their attacks, or if we may expect larger attacks in the future. Finally, we evaluate the effectiveness of blocking ANY queries, as proposed by the IETF, to limit DNS-based DDoS attacks, by estimating the decrease in attack volume when switching from ANY to other query types.Our results show that by blocking ANY, the response size of domains observed in attacks can be reduced by 57%, and the size of most-potent domains decreases by 69%. However, we also show that dropping ANY is not an absolute solution to DNSbased DDoS, as a small but potent portion of domains remain leading to an expected response size of over 2,048 bytes to queries other than ANY.

show abstract

Section: A Dnsmentioning

confidence: 99%

Section: Categorization Of Txt Recordsmentioning

confidence: 99%

See 1 more Smart Citation

ANYway: Measuring the Amplification DDoS Potential of Domains

Toorn

Krupp

Jonker

et al. 2021

2021 17th International Conference on Network and Service Management (CNSM)

Self Cite

View full text Add to dashboard Cite

show abstract

“…There is also an experimental RFC 1464 dated back to 1993 that suggests to define the format of TXT RDATA fields as the ''attribute name followed by the value of the attribute''. However, despite this experimental RFC the TXT records are in practice used in arbitrary defined format and TXT RRs usage increased over the last years [37]. Some of the most common production TXT RR usecases are:…”

Section: Embedding Free-form Information Into Dns Recordsmentioning

confidence: 99%

DNS-embedded service endpoint registry for distributed e-Infrastructures

Salnikov

Kónya

2021

Cluster Comput

View full text Add to dashboard Cite

Distributed e-Infrastructure is a key component of modern BIG Science. Service discovery in e-Science environments, such as Worldwide LHC Computing Grid (WLCG), is a crucial functionality that relies on service registry. In this paper we re-formulate the requirements for the service endpoint registry based on our more than 10 years experience with many systems designed or used within the WLCG e-Infrastructure. To satisfy those requirements the paper proposes a novel idea to use the existing well-established Domain Name System (DNS) infrastructure together with a suitable data model as a service endpoint registry. The presented ARC Hierarchical Endpoints Registry (ARCHERY) system consists of a minimalistic data model representing services and their endpoints within e-Infrastructures, a rendering of the data model embedded into DNS-records, a lightweight software layer for DNS-record management and client-side data discovery. Our approach for the ARCHERY registry required minimal software development and inherits all the benefits of one of the most reliable distributed information discovery source of the internet, the DNS infrastructure. In particular, deployment, management and operation of ARCHERY is fully relying on DNS. Results of ARCHERY deployment use-cases are provided together with performance analysis.

show abstract

“…• O. van der Toorn, R. van Rijswijk-Deij, T. Fiebig, M. Lindorfer, and A. Sperotto. "TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records", in the Workshop on Traffic Measurements for Cybersecurity (WTMC), co-located with IEEE European Symposium on Security and Privacy Workshops (EuroSP), 2020 [61].…”

Section: Introductionmentioning

confidence: 99%

Proactive threat detection : a DNS based approach

Toorn¹

View full text Add to dashboard Cite

Peter and Anneke, I'd like to thank you personally for allowing me to figure-out my own path in life. You have always supported me in every choice I made, regardless of the direction it would take me. And you were there when I needed you. Thank you.Finally, and certainly not last. Lien, you are truly special to me. Even when my Ph.D. work, Storro work, the combination thereof, or life in general, got me stressed and moody you stood by my side. You were there when I needed you, or offered me some 'Twentse nuchterheid' to get me back on the rails.

show abstract

TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records

Cited by 8 publications

References 13 publications

ANYway: Measuring the Amplification DDoS Potential of Domains

ANYway: Measuring the Amplification DDoS Potential of Domains

DNS-embedded service endpoint registry for distributed e-Infrastructures

Proactive threat detection : a DNS based approach

Contact Info

Product

Resources

About