News

Unmanaged DNS Servers a Growing Security Risk

• By William Jackson
• 11/16/2009

The adoption of a set of Internet security protocols called Domain Name System Security Extensions (DNSSEC) is accelerating, with the number of signed zones more than tripling in the last year, according to a recent study. But this good news is offset by the growing number of unmanaged embedded name servers.

The study, conduced by Infoblox Inc., was a mixed bag of good and bad news, said Vice President of Architecture Cricket Liu.

"There are some things to be happy about, but there are some worrisome things, too," Liu said.

The estimated number of name servers on the Internet jumped from 11.7 million in 2007 to 16.3 million in this year's scan. That in itself is not bad news, but that growth is believed to be responsible for the sharp increase in recursive servers -- name servers that accept queries from any IP address and are more vulnerable to being used in denial-of-service (DoS) attacks. The percentage of open recursive servers jumped to nearly 80 percent in this year's study, from 52 percent in 2007.

"That sort of overrides the good news," Liu said.

The Domain Name System (DNS) maps domain names to numerical IP addresses, directing Internet inquiries to the appropriate location. Name servers do this resolution for essentially every Internet request. Protecting the system from vulnerabilities that could allow addresses to be spoofed, traffic to be hijacked or servers to be subjected to DoS attacks is critical to the health and availability of the Internet.

The study is the fifth annual study of domain name servers on the Internet conducted by Infoblox and the Measurement Factory. It is based on a sample of 5 percent of the Internet's IPv4 address space, which is scanned for name servers. The servers are then queried for information about their software and configuration.

"I think the numbers are pretty good," Liu said of the study. "I feel confident that the trends we identified are real."

The explosion in the number of name servers is believed to be due to the growing number of people getting broadband access, because many broadband access devices have built-in DNS proxies.

"It's our theory that these are customer-premises equipment being deployed by some big European carriers," Liu said. "In their default configuration, they are not very secure and need to be locked down."

But owners often are unaware of the embedded servers or assume the equipment is configured appropriately and do not lock them down. Carriers should be aware of the configurations of the equipment they are providing to customers, and the industry needs to set minimum standards for configuring embedded proxies, limiting the recursion that is allowed, Infoblox advised.

"Recursion is absolutely necessary in order for DNS to work," Liu said, warning that most name servers should not be completely open and servers in customer-premises equipment should be open only to the carrier's subscribers.

The scan showed that the number of zones signed using DNSSEC jumped from 45 to 167 in the past year. DNSSEC is a security protocol that allows DNS queries and answers to be digitally signed and authenticated, helping prevent spoofing and other malicious activities.

"The numbers, in an absolute sense, are small," Liu said. "But people do seem to be interested in it. It's catching on."

The interest is being driven in part by the growing number of products that help automate management of signed zones and the number of parent zones that are being signed. The parent zones .gov and .org have been signed, and .net and the root zone are expected to be signed in 2010. Subzones in the .gov domain are expected to be signed this year.

Other good news in the study is that the percentage of zones with servers that are open to zone transfers dropped from 31 percent last year to 16 percent this year. Zone transfers require more of a name server's computing resources to process, making these servers more attractive targets for DoS attacks. Administrators appear to be paying more attention to the configuration of external DNS servers, the Infoblox report said.

Other best practices recommended in the report include:

• Upgrade to the most recent version of BIND, the most common DNS software. Earlier versions have well-known and easily exploited vulnerabilities.
  
  
• Use port randomization to protect against the Kaminsky cache-poisoning vulnerability.
  
  
• Consider appliances that are easily upgraded.
  
  
• Separate internal and external name servers.
  
  
• Separate authoritative and recursive name servers.