1

I've heard of a case wherein the domain name of the secondary name server was expired and free to register.

Let's say example.com has two registered nameservers:

  1. example-ns1.com (primary)
  2. example-ns2.com (secondary)

The domain example-ns2.com is expired and free to register. If an "attacker" claims the domain name of the second name server.

  1. Would that only affect example.com when the name server with domain example-ns1.com is offline?
  2. Will the "attack" only work when DNSSEC was not (properly) implemented before example-ns2.com expired?
Bob Ortiz
  • 6,234
  • 8
  • 43
  • 90

1 Answers1

4

DNS resolvers choose the name server to obtain the answer from randomly. There is no difference between primary and secondary NS servers from this point of view.

If you have 2 NS servers and one is compromised in any way, there is roughly a 50% chance that the caching DNS server asks a compromised NS server. When it does and gets a spoofed reply (possibly pointing to malicious target), it will remember such reply and return it to all subsequent queries for the same DNS name until the TTL of the reply expires (which can be realy long, like several days, if the attacker is clever enough).

If the visitor of such site uses a properly configured, DNSSEC-aware recursive resolver (caching DNS server) and the example.com domain is signed with DNSSEC, he is quite safe.

The DNS resolver verifies the answer from authoritative name server against the DS records from the parent zone (in this case the .com zone). If the answer is spoofed, resolver returns and error (and does not cache the wrong answer). Only if the cryptography used for signing the DNS zone in question (or any of the parent zones) is broken or the secret keys are known to the attacker, only then he could spoof such DNS reply.

dave
  • 176
  • 4