Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

The introduction of the new top level domains (TLDs) such as .music, .books, etc. will increase the number of people and organisations adding and removing entries into the root DNS servers (.) for their own TLD.

Given the TLDs "me." and "in.", this means they will have different protections in place to create and manage subdomains ( myna.me. , bitco.in. ). Sure the root servers have an established protocol to work with TLDs, but what's to say that the TLDs ability to interact with the root servers hasn't been spoofed or intercepted by an adversary.

Question

The risk I'm concerned about is, what is to prevent a malicious actor from adding or removing NS hosts? If a hacker could add a rogue NS for a TLD, that would obviously give the attacker complete control over all subdomains, the DNSSec records, and many other aspects of security including SSL.

There are other security issues to be concerned about, such as is the registration process for the TLD's registration web portal, are the correct controls in place? Have audits been done?

  • Are there any documented cases of DNS hacking at the TLD level?
  • What mitigates this risk?
  • Is there a standard, accreditation, or assurance that I can rely on before using a given second level TLD?
  • Is any third party that watches the DNS roots of .COM / .NET / .ORG (etc) and monitors them for changes?

This risk is particularly concerning as more and more people rely on URL shorteners to make "cute" URLs. In essence they are allowing a 3rd party, whose government may not allow for privacy protections, lawsuits, or other support we would otherwise expect, if that DNS provider were to be hacked.

Example of different TLDs that have some name servers, how do we know these servers are correct?

> com.
Server:  a.root-servers.net
Address:  198.41.0.4

Name:    com
Served by:
- m.gtld-servers.net
          192.55.83.30
          com
- l.gtld-servers.net
          192.41.162.30
          com
- k.gtld-servers.net
          192.52.178.30
          com
- j.gtld-servers.net
          192.48.79.30
          com
- i.gtld-servers.net
          192.43.172.30
          com
- h.gtld-servers.net
          192.54.112.30
          com
- g.gtld-servers.net
          192.42.93.30
          com
- f.gtld-servers.net
          192.35.51.30
          com
- e.gtld-servers.net
          192.12.94.30
          com
- d.gtld-servers.net
          192.31.80.30
          com


> biz.
Server:  a.root-servers.net
Address:  198.41.0.4

Name:    biz
Served by:
- a.gtld.biz
          156.154.124.65
          2001:503:7bbb:ffff:ffff:ffff:ffff:ff7e
          biz
- b.gtld.biz
          156.154.125.65
          biz
- c.gtld.biz
          156.154.127.65
          biz
- e.gtld.biz
          156.154.126.65
          biz
- f.gtld.biz
          209.173.58.66
          2001:500:3682::12
          biz
- k.gtld.biz
          156.154.128.65
          2001:503:e239::3:2
          biz


> me.
Server:  a.root-servers.net
Address:  198.41.0.4

Name:    me
Served by:
- ns2.nic.me
          89.188.44.88
          me
- ns.nic.me
          89.188.44.44
          me
- b2.me.afilias-nst.org
          199.249.127.1
          2001:500:4f::1
          me
- a2.me.afilias-nst.info
          199.249.119.1
          2001:500:47::1
          me
- d0.cctld.afilias-nst.org
          199.254.62.1
          2001:500:28::1
          me
- c0.cctld.afilias-nst.info
          199.254.61.1
          2001:500:27::1
          me
- b0.cctld.afilias-nst.org
          199.254.60.1
          2001:500:26::1
          me
- a0.cctld.afilias-nst.info
          199.254.59.1
          2001:500:25::1
          me


>
share|improve this question

closed as unclear what you're asking by tylerl, Adnan, Xander, NULLZ, Terry Chia Dec 12 '13 at 7:35

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
It is truly unclear what you're asking. Do you think you could rephrase this? –  tylerl Dec 11 '13 at 17:05
    
If you use SSL then this verifies the server identify completely independent of DNS. BTW, the 2nd tier providers do not register their domains with the root servers. Rather the root servers delegate the domains. If I look up bitco.in then the root servers say "go to the name server for .in" –  paj28 Dec 11 '13 at 17:27
1  
@makerofthings7 if you get a spoofed IP address from your DNS query, the server on the fake IP will not have the legitimate server's private key, so the client will detect this. –  paj28 Dec 11 '13 at 17:50
2  
@makerofthings7 if SSL is not secure enough for your needs then I doubt any DNS based solution will satisfy you. A domain registry could be hacked just like a CA could be hacked. –  paj28 Dec 11 '13 at 18:02
2  
How is .us new? It's older than me –  CodesInChaos Dec 11 '13 at 22:56

1 Answer 1

The security of DNS is independent of the particular name hierarchy, as typical DNS-related attacks happen at the resolver instead of at the authoritative server. Furthermore, DNS without DNSSEC is not assumed to be secure any more than telnet is assumed to be a safe remote shell protocol. Security must be layered on elsewhere, such as in TLS.

But to answer your question: each registrar and TLD owner is responsible for his own security, and the reputation of each should reflect that. There is no prescribed security apparatus other than the built-in mechanisms through which DNS operates and the rule and regulatory framework which comprises it.

share|improve this answer
    
As an example, ene example of a new TLD which makes specific mention of their security features is .secure –  Rоry McCune Dec 11 '13 at 18:39

Not the answer you're looking for? Browse other questions tagged or ask your own question.