Dns Attacks Force Security Strategies to Be Rethought |Complete Security

        Dns Attacks Force Security Strategies to Be Rethought

After the blocking of several major sites by Orange, we wanted to understand how such a situation took hold, and how it can evolve. From the management of DNS resolvers by operators to alternatives in development, an overview with expert Stéphane Bortzmeyer.

On the morning of October 17, Orange redirected its customers accessing several sites, including at least Google, OVH and Wikipedia, to the “terrorist sites” blocking page of the Ministry of the Interior. A concern caused by"human error"  during the updating of the diversion system, imposed by the place Beauvau. 

The Ministry called the incumbent operator to account, and demanded the deletion   of the IP addresses concerned from the consultation list of illicit sites. But this incident raises the question of the relevance of having imposed on French ISPs to offer lying DNS resolvers.

As a reminder, a DNS resolver allows you to link a domain name (nextinpact.com for example) to the IP address of the server that hosts it. Its only function is therefore to provide the correct answer quickly. Most often managed directly by operators, this essential building block is not (yet) used in full transparency, for legal, security or commercial reasons.

To understand how we arrived at this situation, and the avenues to come to improve this tool, we spoke with one of its greatest French specialists, Stéphane Bortzmeyer.

Why do operators provide a DNS resolver?

However, it is not obvious that an access provider is the one that manages the DNS resolver of a connection. On the basis of the OSI Model  , commonly used to describe networks, " some IT specialists will answer that the operators manage the network (layer 3), therefore do not have to manage the DNS (layer 7, application) " explains Stéphane Bortzmeyer. However, “ the DNS is special that we cannot do without it. DNS is not a simple application, but an essential infrastructure service for almost everything ”.

Starting from this principle, it is therefore complicated to provide a connection without a DNS resolver, which effectively makes it possible to consult sites and services without technical manipulation on the part of the customer. As part of the network infrastructure, each operator therefore has an interest in internalizing it, to guarantee its proper functioning Complete security.

Could they pool it? “ The problem is, if it breaks down or gets hacked, it's a disaster. The resilience of the Internet depends on not having a single point of failure. Orange had a problem, the others worked, ”Bortzmeyer recalls.

How can a DNS resolver lie?

" This service should indeed be neutral " without possible manipulation of responses, believes the specialist. “ From the moment we start to put a lie function, we add a component. In computer science everything that we graft can mess. Starting with good intentions, we affected the general stability of the Internet, ”notes Bortzmeyer, who believes that French operators lie mainly for legal reasons, rather than for commercial interest.

However, there are some exceptions. In 2009, SFR , for example, redirected  Internet users who entered the address of a site incorrectly to a home page ... containing advertising. For some, however, there are "good" reasons to divert the user from certain sites: child protection, blocking of sites distributing malware ... especially since this function is provided by the main tools behind the servers. DNS, like " RPZ" from BIND software. Clearly, making the system lie does not require great effort.

It is thus by a decree of 2015  that the ISPs were obliged to block access to sites provoking acts of terrorism or defending them, as well as child pornography sites. It is this device which derailed at Orange a few days ago, without any verification or security system preventing it. This is the whole problem: by institutionalizing the possibility of lying for DNS resolvers, we deprive ourselves of the possibility of ensuring that the answer they provide is the right one, which is the basis of their existence.

Besides the usual philosophical questions around state censorship, our interlocutor is also surprised to have seen little of the question of the functioning of the Internet emerging in the debates around administrative blocking, therefore without the intervention of a judge. “ Instead of being threatened by an operator for commercial reasons, Net neutrality is threatened by the state for political reasons. I am not sure that it has an effect against jihadism, but it is visible action in the face of a serious problem, ”he says.

He also considers the public remonstrances of the Ministry of the Interior against Orange " scandalous ". “ They are the ones who imposed this system on the operators! »Recalls the expert.

Can we do without our operator's resolver?

Especially since in practice, such a blockage is easy to circumvent. It is thus quite possible to do without the DNS resolver offered by your access provider, by using a house resolver, or an alternative that you think is trusted. Because even those among the most used worldwide, this point can be a problem.

Cisco's OpenDNS  " is itself a lying resolver, partially disengageable by registering  " notes Bortzmeyer (who detailed his point of view on the subject in 2015 ), when Google's    suffers from belonging to the Internet giant .

In addition, the concentration of these alternatives, some of which are used more heavily than those of access providers, is a new problem. This raises the question of the neutrality of such massive tools, which have become a default response to a concern that should be corrected more deeply.

" It is abnormal for a lazy hotel or hotspot to pass the DNS requests of its customers to Google, given that it is providing their data without their agreement, " said Bortzmeyer, who is also surprised at the habit of certain universities of call to impose this kind of solutions. “ I recently spoke with students at an IUT, where they were told to set up the Cisco OpenDNS resolver. For the 20 years following their release from IUT, they go everywhere and change the configuration as soon as there is a problem, to place this resolver, ”he supports.

The fact remains that the “free” alternatives are few in number, and far from being as impressive as these global behemoths. That of French data Network  or OpenNIC (which offers alternative domain names) are difficult solutions to recommend massively.

It is also possible to set up your own DNS resolver at home, via a turnkey tool such as the Turris Omnia router , funded with the contribution of Internet users, or by installing your own  tool, for example via a Raspberry Pi.  . However, nothing simple and economical seems to exist to self-host your DNS resolver. " The freedom to consult all the content that one wants should be provided to all citizens, not just to geeks " regrets our interlocutor.

Can we trust the network?

If we can doubt which DNS resolver we are using, we can also worry about the network that carries the response to our terminal. DNS requests and responses are very rarely protected, so they are quite easy to handle. An operator can for example prevent the use of a personal resolver, installed behind the customer's box, by blocking port 53 at the output. A practice that would be usual on public hotspots.

However, “ there is worse than blocking port 53, it is its hijacking. In Turkey, the government had imposed a lying DNS on operators to block access to Twitter. So people had generally switched to Google Public DNS [often known for its IP address, 8.8.8.8] , and the government's solution was to divert traffic directed to 8.8.8.8. It's hard to paralyze, ”explains Stéphane Bortzmeyer.

Clearly, when the Turks wanted to use Google's DNS resolver, instead of that of their access providers (forced to block Twitter), the traffic directed to that of Google was repatriated to a controlled resolver.

How do I know if a DNS resolver is lying?

To check if its DNS resolver is telling the truth, and that its traffic is not diverted to the wrong site, the easiest solution is still to compare its results with those of Internet users at other operators. A traceroute command (or tracert on Windows) allows you to see which path is taken to access the site, and possibly detect an anomaly. Solutions which are not very practical, according to Bortzmeyer himself.

However, technical means exist to ensure the veracity of the resolver's response. The main one is DNSSEC. " It is a cryptographic signature of the DNS records ", which makes it possible to compare the one sent by the site with that received. The problem is, even in the case of the Orange incident , it would have been pointless. “ Neither Google nor Wikipedia has signed their DNS zone. It would have worked for my blog, but unfortunately it is never censored! »He laments.

According to data from Apnic  , less than 15% of domain names use DNSSEC validation, including 27.70% in France. Clearly, its use is still very far from being widespread. The reasons given are often those of the weight of the DNSSEC deployment, its complexity and old weaknesses. “ Safety requires that we acquire skills that we did not have before ” answers Stéphane Bortzmeyer. " Those most victims of embezzlement, the major social networks, newspapers or banks, are those who use DNSSEC the least " he thinks, recalling that access providers are also reluctant to validate these signatures.

These DNSSEC signature validations must make it possible to verify that a third party certifies the data sent by the site. If an operator with millions of customers validates a signature, then it is surely correct. “ The only French operator that validates DNSSEC by default is Free. All Free subscribers are protected, but the validation being made by Free, this does not prevent legal lies, the Beauvau blacklist ”further summarizes the expert.

Solutions in development, to be generalized

However, we should not believe that the situation is blocked. The projects claiming to be revolutionary are multiplying, part of which is already used by some Internet users. This is the case, for example, with “.onion” domain names in the Tor network, which does not rely on the DNS system to link the site address to the server. Its advantage: being already used by Internet users without great technical skills, who use Tor via a turnkey browser.

Other systems rely on the blockchain  , which must ensure that the information is true by automatically validating each modification by the members of the network. This is for example the case of Namecoin , an experimental project which relies on a unique top-level domain name, the “.bit”. There is also GNUnet,  , which offers a decentralized system. " It's the one I prefer, but it's the least deployed " says the expert.

More specifically, within the IETF, the main design body for Internet standards, solutions have also been validated to improve the security of the existing DNS. This is for example the case of DNS on TLS (see this post    by Stéphane Bortzmeyer), whose RFC was finalized barely four months ago. We must therefore start to deploy it, to end the journey of unencrypted DNS data on the Internet. This is also the goal  of DNs of DNS Crypt  , a project outside the IETF, which also offers to authenticate the connection between the DNS resolver and the client.

“ What the IETF offers is a resolver accessible in DNS over TLS, with data validation by DNSSEC. With that, normally, we are good. If people don't deploy it, it's not the fault of the IETF, ”says Stéphane Bortzmeyer.

Internet users condemned to trust their DNS resolver

However, despite better network security (via DNS over TLS or DNSCrypt) or verification of the data exchanged (via DNSSEC), the Internet user must always trust his DNS resolver. In the current system, it must inevitably trust a server, in the vast majority of cases itself going through the Internet to connect to the user.

For Stéphane Bortzmeyer, the real basic problem is knowledge of these issues by users, who depend on the proper functioning of these systems without knowing them. “ The state of understanding of computing is appalling in a society where it is everywhere. There is a significant gap between the money spent on deploying it and the money spent on developing digital literacy, ”he believes.