JAPAN REGISTRY SERVICES

DNS Hijacking
Inappropriate domain name management causes DNSHijacking
IEPG Meeting
Nov. 6, 2005
Kazunori Fujiwara, JPRS
<fujiwara@jprs.co.jp>

Copyright © 2005 Japan Registry Services Co.,LtdJAPAN REGISTRY SERVICES

What is ‘inappropriate domain namemanagement’?
• Registrants have to manage– DNS servers that provide zone information (Child)• Contains DNS servers’ information– DNS servers’ information that is registered to registry(Parent)• Child and Parent should be synchronized– If not, it causes lame delegation– If not, it is in one of inappropriate states• Typical inappropriate states– Registering incorrect name (typo)– Leaving expired (non-existing) domain name in Parent– Leaving non-working DNS server as Child• These states may cause DNS hijacking.
Copyright © 2005 Japan Registry Services Co., Ltd.

2JAPAN REGISTRY SERVICES

How ‘domain name hijack’ can happen?
• Suppose DNS server’s domain name exists no more
– EXAMPLE.JP has NS1.EXAMPLE.JP and NS2.NOTEXIST.
JP as its name servers, but NOTEXIST.JP was expired andnot existent any more
– Anyone can register NOTEXIST.JP and setupNS2.NOTEXIST.JP as a DNS server of EXAMPLE.JP– Then he/she can forge zone information so that DNS
responses from NS1.EXAMPLE.JP and from
NS2.NOTEXIST.JP are different• This situation easily happen– If domain name registration manager and DNS operation
manager in registrant organization are different and theiractivities are not synchronized

Copyright © 2005 Japan Registry Services Co., Ltd.

3JAPAN REGISTRY SERVICES

How ‘domain name hijack’ can happen?
EXAMPLE.JP has two DNS servers:
NS1.EXAMPLE.JP
NS2.NOTEXIST.JP
NS1.EXAMPLE.JP

redundancy

NS2.NOTEXIST.JP

NS2.NOTEXIST.JP

EXAMPLE.JP zone is here:
WWW.EXAMPLE.JP A
forged EXAMPLE.JP zone is here
EXAMPLE.JP zone is here: WWW.EXAMPLE.JP A
WWW.EXAMPLE.JP A
WWW.EXAMPLE.JP

web site

WWW.EXAMPLE.JP(1) Appropriate management(2) Expiration of NOTEXIST.JP
Forged web site(3) Registration of NOTEXIST.JP
by 3rd party

Copyright © 2005 Japan Registry Services Co., Ltd.

4JAPAN REGISTRY SERVICES

Case study : in Japan (1/2)• One domain name had two DNS servers– A famous credit card company’s domain name– One DNS server kept working but the other stopped its
operation (April 2005)• Stopped DNS server’s domain name was expired.
One month after, anyone could register expired
domain name. (May 2005)– An attacker could register the domain name and run
malicious authoritative DNS server.
– In this situation, forging to DNS and phishing is very easy

• One person warned this situation to Japanesecommunity• Now, it has been fixed
Copyright © 2005 Japan Registry Services Co., Ltd.

5JAPAN REGISTRY SERVICES

Case study : in Japan (2/2)• IPA (a governmental organization)
announced a security advisory about thisissue• After that, JPRS, JPCERT, and Ministries
announced their advisories• Articles about this were published on various
web sites• National newspaper Asahi-Shimbun wrote itup.
– http://www.asahi.com/english/Herald-asahi/TKY200510030127.html

Copyright © 2005 Japan Registry Services Co., Ltd.

6JAPAN REGISTRY SERVICES

Who is responsible?
• Registrant of the domain name is responsiblefor its management– Registrant should confirm and keep the configuration
appropriate– TLD registries sets and modifies the zone data reflecting theinstructions given by Registrants or Registrars• On the other hand, registries/registrars can checkand find inappropriately managed domain names– What roles should registries play?
• Education• Check & individual notification

Copyright © 2005 Japan Registry Services Co., Ltd.

7JAPAN REGISTRY SERVICES

What TLD registry can do• Promote Registrants' understanding about DNS– Through web pages of registries/registrars/ISPs/…
– Through news from media– Through public lectures• Check the status of domain names and warn theregistrants/registrars about the inappropriateness– Only TLD registries can check all the domains– But it is difficult to check the appropriatenessif registered DNS server name is not under the TLD– Therefore, cooperation between registries is required• Disable DNS delegation if the domain name is
exposed to significant danger– With or without any consent/notification to the registrar
Copyright © 2005 Japan Registry Services Co., Ltd.

8JAPAN REGISTRY SERVICES

What JPRS did• Expressed public warning on its Web site
• Checking appropriateness of DNS setting
under .JP
– Not checked if DNS servers are not under .JP• Sending warning mails to registrars (monthly)• Sending warning to registrants (monthly)– E-mail– Postal mail• Start implementing to disable inappropriate
DNS delegation
Copyright © 2005 Japan Registry Services Co., Ltd.

9JAPAN REGISTRY SERVICES

Consideration and inquiries•••

What should we do as TLD registry ?

–LAME delegation check and disabling delegation includes this–

It is difficult to check the appropriatenessif registered DNS server name is not under the TLD

Collaborative checking among TLDs is required

Do you cope with inappropriate domain namemanagement ? If you will do, please let me know!

–––Do you face such domain name hijacking?
What kind of measures have you taken to address this issue?
Results

Copyright © 2005 Japan Registry Services Co., Ltd.

10JAPAN REGISTRY SERVICES

Questions/Comments?

Copyright © 2005 Japan Registry Services Co., Ltd.

11