Speaker
Description
This presentation will focus on dangers attributed to clients when they use a parent validating DNSSEC resolver. Specifically, we will quickly highlight an attack associated with parent-centric resolvers that choose not to validate the upstream delegation information. We’ll follow this with some attack demonstrations of the types of malicious activity that can be accomplished because of this failing to validate delegation records. During the demonstration, I will show how a carefully positioned partial man-in-the-middle can increase their attack surface to the rest of the domain name system in some cases. Using this approach, I will then demonstrate how some important DNS records can be manipulated that would not normally have been visible to the attacker before this attack took place. The ramifications of each of these record types under attack will be discussed, along with the vulnerabilities each record type reveals. Finally, I will conclude with an evaluation of the pros and cons of selecting client-centric vs parent-centric resolvers.
| Talk duration | 20 Minutes (+5 for Q&A) |
|---|
