DNS (BIND, djbdns) JPNIC・JPCERT/CC Security Seminar 2005

Size: px

Start display at page:

Download "DNS (BIND, djbdns) JPNIC・JPCERT/CC Security Seminar 2005"

うまじみうら
7 years ago
Views:

1 DNS JPNIC JPCERT/CC Security Seminar 2005

2 DNS Pharming BIND djbdns 2

3 DNS

4 DNS (Domain Name System)? IP IP

5 DNS(Domain Name System) 5

6 WEB IP WEB PC IP DHCP IP WEB 6

7 IP NS PC PC NS IP NS. ( ) IP.(13 ).. jp jp NS jp IP jp(5 ) jp example.jp example.jp NS example.jp IP example.jp IP NS PC IP 7

8 2 (1) IP jp example.jp Authoritative Nameserver DNS 8

9 NS PC PC NS IP NS. ( ) IP.(13 ).. jp NS jp IP jp(5 ) jp example.jp NS example.jp example.jp IP example.jp IP NS PC IP 9

10 2 (2) IP? IP ? DHCP PPP PC PC 10

11 NS PC PC NS IP NS. ( ) IP.(13 ).. jp NS jp IP jp(5 ) jp example.jp NS example.jp example.jp IP example.jp IP NS PC IP 11

12 NS RR RR RR - Resource Record (example.jp JP ) (example.jp) 12

13 (Glue) RR NS RR RR A RR AAAA RR RR 13

14 NS NS PC.(13 ). jp(5 ) example.jp ( NS ) PC NS IP NS. ( ) IP. jp NS jp IP jp example.jp NS example.jp IP example.jp IP NS PC IP 14

15 NS ( ) NS ( ). DNS RR 15

16 . NS RR ( ns.example.net) IP 16

17 DNS 17

18 NS RR DNS NS RR ) NS RR ns0 ns1 ns0 ns1 ns1 ns0 ns1 18

19 NS 1 19

20 example.jp example.net 100% example.net example.jp example.net MX RR, CNAME RR RR 20

21 Pharming ( )

22 Pharming Phishing ( ) fishing( ) Pharming ( ) farming( ) ( ) Phishing 22

23 Pharming DNS ( ) hosts DNS hosts ID 23

24 Cache Poisoning ( ) DNS Pharming A A Root servers JP DNS servers A example.jp 24

25 Cache Poisoning example.gr.jp example.jp > 25

26 Cache Poisoning BIND 8 or 4 Windows 2000 SP2 26

27 (forwarder) Cache2 Cache1 PC.(13 ). jp(5 ) example.jp Cache1 Cache2 Cache2 Cache2 BIND 8 or 4 Cache1 Windows DNS BIND 9 27

28 DNS IPA Pharming 28

29 IPA (1) 1 (or ) ) example.jp example.net example.net dns1.example.net 29

30 IPA (2) DNS ns1.example.jp example.jp example.jp example.net example.net dns1.example.net 30

31 IPA (3) example.jp dns1.example.net example.jp Pharming ( 50%) 31

32 IPA (4) example.net example.net provider.dom 25% example.jp. 32

33 IPA (5) ( ) l k IP

34 DNS Squish DNS Checker DNS Report Zone Check 34

36 BIND named 1 Windows DNS djbdns tinydns dnscache NSD 36

37 BIND ( ) 37

38 BIND 8 (4 ) BIND 9 38

39 TIPS BIND 39

40 (BIND 8) (DoS) 40

41 Cache Poisoning ( ) 41

43 LAN Man in the Middle Attack Pharming A A A Root servers JP DNS servers example.jp 43

44 LAN LAN 44

45 DNS ARP Poisoning 3 (A,B,C) A B C ARP Spoofing 45

46 ARP Poisoning (1/4) 3 A( B( ) GW( ) 46

47 ARP Poisoning (2/4) B root B ARP A MACaddr 0:3:3:3:3:3 GW MACaddr 0:3:3:3:3:3 A GW ARP B 47

48 ARP Poisoning (3/4) B IP Layer2 B A B GW ARP Poisoning 48

49 ARP Poisoning (3/4) ARP Poisoning OS ARP syslog 49

50 ARP Poisoning ARP 50

51 DNS ( ) RR ID (Query ID) Query ID 16bit RR ID UDP DNS 53 51

52 ID (1) Cache Poisoning Pharming 52

53 ID (2) RR ID 16bit BIND named DNS 53 ID Cache Poisoning 1/

54 ID (3) dnscache(djbdns ) 1/2 32 DNS 54

55 DNS SSH SSL/TLS RFC3833 Threat Analysis of the Domain Name System (DNS) DNSSEC 55

56 DNSSEC DNS Security Extension RFC4043,4044,4045 DNS DNS DNS 56

57 BIND

58 BIND?? BIND? 58

59 BIND named.conf recursion no; fetch-glue no; BIND9 no hint (zone. ) zone options { } ;... recursion no; fetch-glue no;... zone "example.jp" { } ; type master ; file "example.jp.zone" ; 59

60 BIND recursion yes; fetch-glue no; hint allow-query (localhost) ::1 options {... recursion yes; fetch-glue no; allow-query { /8 ; ; };... }; zone "." { type hint; file "named.root"; }; zone " IN-ADDR.ARPA" { type master; file "localhost.rev"; }; 60

61 1 (1/3) named 2 /etc/named.conf options {... recursion no; fetch-glue no; listen-on { ; } ;... } ; listen-on IP 61

62 1 (2/3) /etc/cache.conf named c /etc/cache.conf options {... pid-file "/var/run/cache-named.pid" ; listen-on { ; } ;... }; /etc/resolv.conf nameserver

63 1 (3/3) listen-on controls dump-file statistics-file 2 named 63

64 BIND 8 DoS BIND 9 BIND 8 options {... allow-transfer { ; };... } ; zone "example.jp" { type master ; file "example.jp.zone" ; allow-transfer {... } ; } ; 64

65 BIND 9 BIND 8 options {... max-cache-size 100M;... } ; 65

66 example.jp ns ;; flags: qr aa rd ra; recursion yes ; < > < > 66

67 named (1) root named named u <user> /var/run/named.pid 67

68 named (2) named chroot named t <chroot > BIND9 djbdns chroot 68

69 BIND : :

70 djbdns

71 djbdns BIND (1) tinydns dnscache dnscache 71

72 djbdns BIND (2) chroot 72

73 dnscache root/ip "/" root/ip/ /8 root/ip/ /16 root/ip/ / /29 8 root/ip/ root/ip/

74 djbdns BIND 74

75 Q & A 75

DNS DNS(Domain Name System) named(bind), tinydns(djbdns), MicrosoftDNS(Windows), etc 3 2 (1) ( ) IP IP DNS 4

DNS minmin@jprs.co.jp DNS DAY Internet Week 2003 ( ) 2 DNS DNS(Domain Name System) named(bind), tinydns(djbdns), MicrosoftDNS(Windows), etc 3 2 (1) ( ) www.example.jp IP IP 10.20.30.40 DNS 4 PC /etc/resolv.conf