1

I start learning about DNS and DNSSEC. I discovered DNSSEC work similar to a PGP signature. A piece of data signed by a key and the key signed by another key. So, I have an attack might work with some assumption, but I want some validation will this work.

Assuming an attacker had intercepted a network, and able to manipulate the packet. A client request a DNS record from Google's public DNS. DNS responses with legit answer. Now the attacker intercept the response packet, modify the answer and remove any DNSSEC related information. Client directed to attacker's site.

The attack basically remove the DNSSEC related information. Since client doesn't have any info to verify the data, it only can trust and connect the IP address within the DNS answer. And the attacker don't need to spoof the target domain and its parent because it is just a simple subtraction.

Is this attack possible or DNSSEC have some kind of mechanism to prevent this happen?

Improve this question

1 Answer 1

Reset to default
1

There's a chain of trust that stops this:

The DNS root itself is signed with DNSSEC. This is well-known to clients that support DNSSEC at all. When the DNS root provides records about (e.g.,) the .com domain, its response will include a DS record to indicate that that domain should be signed as well. This works again at subsequent levels: the .com domain will provide a DS record to indicate that example.com is supposed to be signed with DNSSEC.

Because of this, an attacker who removes any DNSSEC record will break the validity of the previous level's DNSSEC, and removing DNSSEC from the root is a clear signal that tampering has occurred.

Caveat: the above only works if every piece of the domain is signed. If example.com isn't signed but secure.example.com is, the attack you're describing does become possible unless the resolver knows of the trust anchor for secure.example.com.

Sources:

Improve this answer
3
  • According to the Wiki page, Windows 7 uses a "non-validating but DNSSEC-aware stub resolver." Is that mean Win7 will not check the signature but will warn the user if the DNSSEC related records stripped off?
    – Hartman
    Mar 1, 2017 at 4:18
  • 1
    That means that Windows 7 doesn't do any DNSSEC validation itself at all. If its configured nameserver doesn't support DNSSEC, or if there's a MITM attack between it and its configured nameserver, DNSSEC offers it no protection at all.
    – Joseph Sible-Reinstate Monica
    Mar 1, 2017 at 4:21
  • From what I understand, it will work if we query .com and then the domain nameserver, and so on. But what if use a service like 8.8.8.8. Can the attacker just remove the DNSSEC header in that case?
    – VarunAgw
    Jan 22, 2021 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.