Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite

In DNSSEC, NSEC records are used to provide proof of nonexistence. The trouble is that these records provide pointers to existent domain names (the closest known domain in either direction) constructing a chain that can be "walked" to eventually disclose all domain names in a given zone through further failed queries.

The method as I understand it relies on crafting queries for domains that do not have a corresponding record. Are zones with wildcard DNS records still somehow susceptible to this attack?

share|improve this question
What are you trying to hide from attackers? – curiousguy Jul 3 '12 at 16:20
The information potentially disclosed are domain names. The question however is not how to "best" stop this, but rather whether those zones are still susceptible. Zones with wildcard records are an edge case I am interested in understanding. – chao-mu Jul 3 '12 at 18:19
"wildcard DNS" you mean a domain foo.bar such that x.foo.bar returns the same DNS record, for every x ? – curiousguy Jul 4 '12 at 6:31
Yes, that is my understanding. So I am searching for a case that even in those conditions, proof of nonexistence is needed. Hence the edginess of the case. – chao-mu Jul 4 '12 at 15:46
baz.foo.bar may exist, but what about qux.baz.foo.bar? – curiousguy Jul 4 '12 at 16:01

1 Answer

up vote 1 down vote

They should still be vulnerable, since the wildcard record is signed as literally "*". The details of how wildcard results are handled are covered in RFC 2535 (DNSSEC), RFC 3845 (NSEC RDATA format), and RFC 5155 (NSEC3 hashed responses).

This simple description was helpful to me in understanding how a wildcard response can be proven: "The receiving nameserver can derive from this that the record 'www.example.com' was synthesised from '*.example.com', and check the signature accordingly."

It is possible that some tools and scripts designed to conduct NSEC-walking would fail in the case of wildcard responses, but this would not prove that the attack is not still possible.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.