DNSSEC and its potential for DDoS attacks: A comprehensive measurement study

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2014, Pages 449-460

  Van Rijswijk Deij, Roland ^a   Sperotto, Anna ^a   Pras, Aiko ^a  

^a UNIVERSITY OF TWENTE   (Netherlands)

Author keywords

Amplification attack; Attack; DDoS; Denial of service; DNS; DNSSEC; Measurements; Reflection attack

Indexed keywords

ELECTRONIC DOCUMENT IDENTIFICATION SYSTEMS; INTERNET PROTOCOLS; INTRUSION DETECTION; MEASUREMENT; NETWORK SECURITY;

ATTACK; DDOS; DENIAL OF SERVICE; DNSSEC; REFLECTION ATTACKS;

DENIAL-OF-SERVICE ATTACK;

EID: 84910140759     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2663716.2663731     Document Type: Conference Paper

References (23)

1. L. Garber. Denial-of-service attacks rip the Internet. Computer, 33(4):12{17, April 2000.
2. D. Anstee, A. Cockburn, and G. Sockrider. Worldwide Infrastructure Security Report. Technical report, Burlington, MA, USA, 2014.
3. P. Mockapetris. RFC 1035 - Domain Names - Implementation and Specification, 1987.
4. D. Kaminsky. Black Ops 2008: It's the End of the Cache As We Know It. In Black Hat USA, 2008.
5. A. Cowperthwaite and A. Somayaji. The futility of DNSSec. 5th Annual Symposium on Information Assurance (ASIA10), page 28, 2010.
6. D.J. Bernstein. High-speed high-security cryptography: encrypting and authenticating the whole Internet. In 27th Chaos Communication Congress (27C3), Berlin, 2010.
7. M. Kührer, T. Hupperich, C. Rossow, and T. Holz. Exit from Hell? Reducing the Impact of Amplification DDoS Attacks. In Proc. of the 23rd USENIX Security Symposium, August 2014.
8. J. Damas, M. Graff, and P. Vixie. RFC 6891 - Extension Mechanisms for DNS (EDNS(0)), 2013.
9. C. Kreibich, N. Weaver, B. Nechaev, and V. Paxson. Netalyzr: Illuminating the Edge Network. In Proceedings of IMC 2010, pages 246{259, New York, USA, 2010. ACM Press.
10. R. Vaughn and G. Evron. DNS Amplification Attacks (preliminary release). 2006.
11. J.J. Santanna and A. Sperotto. Characterizing and Mitigating The DDoS-as-a-Service Phenomenon. In 8th International Conference on Autonomous Infrastructure, Management and Security (AIMS), LNCS, Brno, Czech Republic, 2014. Springer.
12. O. Kolkman and R. Gieben. RFC 4641 - DNSSEC Operational Practices, 2006.
13. R. Arends, R. Austein, M. Larson, D. Massey, and S. Rose. RFC 4034 - Resource Records for the DNS Security Extensions, 2005.
14. O. Kolkman, W. Mekking, and R. Gieben. RFC 6781 - DNSSEC Operational Practices, Version 2, 2012.
15. P. Ferguson and D. Senie. BCP 38 - Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing, 2000.
16. D. Eastlake. Domain Name System (DNS) Cookies (Internet Draft), 2014.
17. G. van den Broek, R. van Rijswijk-Deij, A. Sperotto, and A. Pras. DNSSEC Meets Real World: Dealing with Unreachability Caused by Fragmentation. IEEE Communications Magazine, 52(4):154{160, 2014.
18. M. Geva, A. Herzberg, and Y. Gev. Bandwidth Distributed Denial of Service: Attacks and Defenses. IEEE Security & Privacy, 2013.
19. S.T. Zargar, J. Joshi, and D. Tipper. A Survey of Defense Mechanisms Against Distributed Denial of Service (DDoS) Flooding Attacks. IEEE Communications Surveys & Tutorials, 15(4):2046{2069, January 2013.
20. E. Casalicchio, M Caselli, and A Coletta. Measuring the global domain name system. IEEE Network, 27(1):25{31, January 2013.
21. C. Rossow. Amplification Hell: Revisiting Network Protocols for DDoS Abuse. In Proceedings of the 2014 Network and Distributed Systems Security Symposium (NDSS 2014), number February, pages 23{26, San Diego, 2014. Internet Society.
22. M. Anagnostopoulos, G. Kambourakis, P. Kopanos, G. Louloudakis, and S. Gritzalis. DNS amplification attack revisited. Computers & Security, 39(February 2012):475{485, 2013.
23. P. Hoffman and W.C.A. Wijngaards. RFC 6605 - Elliptic Curve Digital Signature Algorithm (DSA) for DNSSEC, 2012.