DNS Fundamentals An AntiAbuse Perspective Carlos lvarez ISSSR

DNS Fundamentals (An Anti-Abuse Perspective) Carlos Álvarez, IS-SSR Team | Steve Conte , Office of the CTO 18 May 2016

Domain Name System 1 • Internet Identifiers Resolution Process • Structure and Resolution 2 • Parties Involved Registration Process • Registration • Whois 3 Why all this matters: Anti. Abuse | 2

DNS: Internet Identifiers MAC, IP, Domains | 3

DNS: Structure and Resolution “. ” edu org club string. tld. root – “. ” biz Top Level Domain ar TLD – “. org. ” any isoc icann whois gacweb SLD – Second Level Domain 2 nd Level – “icann. org. ” 3 rd Level – “gacweb. icann. org. ” 4 | 4

DNS: Structure and Resolution string. tld. m. root-servers. net dns. icann. org 2 3 1 8 4 6 7 www. icann. org? a 0. org. afilias-nst. info 5 ns 1. icann. org 5 | 5

DNS: Registration Process Who does what? 6 | 6

<command> <create> DNS: Registration Process • SRS (market competition) / EPP • Availability check / response • Provision of account information and WHOIS • Registrar receives, adds to own DB, forwards to Registry • Registry adds entry in its zone 7 | 7

DNS: WHOIS Contacts: Registrant, Admin Contact, Tech Contact, Billing Contact Registration Info • Postal address, email, phone, fax • Timestamps, statuses, name servers • Accuracy • Validation, i. e. emails in RFC 5322, phone numbers in ITU-T E. 164, postal addresses in UPU or S 42 format template • Verification: Registrant or Account Holder email or telephone requiring affirmative response 8 | 8

DNS: Why all this matters Anti-Abuse 9 | 9

DNS: Why all this matters Anti-Abuse Some hot topics regarding abuse of registration services: – Resellers: Identified by Registrar? Responsive? – Privacy/Proxy services: Relay/Reveal – Compliance with RAA abuse provisions: Review and Respond • Suspension/cancellation of malicious domains? • DNS Sinkholing? • Not enough data or false positive? – Domain Generation Algorithms: Automated! – Threats: • Botnet command control • Malware distribution • Phishing/pharming 10 | 10

DNS: Why all this matters Anti-Abuse Some hot topics regarding abuse of resolution services: m. root-servers. net dns. icann. org 2 3 1 8 7 4 5 6 a 0. org. afilias-nst. info ns 1. icann. org DNS Hijacking / Cache Poisoning 11 | 11

DNS: Why all this matters Anti-Abuse Some hot topics regarding abuse of resolution services: DNS Servers (ISPs, own) http: //string. tld x Victim Reflection+Amplification=DDo. S 12 | 12

ICANN One World. One Internet | 13

Engage with ICANN Questions? carlos. alvarez@icann. org / steve. conte@icann. org @isitreallysafe twitter. com/icann gplus. to/icann facebook. com/icannorg weibo. com/ICANNorg linkedin. com/company/ican n flickr. com/photos/icann youtube. com/user/icannnew s slideshare. net/icannpresentations | 14