2

When setting up secure server, it is suggested not to use self-signed certs and instead to be signed by a CA. Of course, post-Snowden we now know that there may be problems with CA's that could allow MITM attacks.

My question then is if a domain is setup with proper DNSSEC, is it immune from does this mitigate the types of MITM attacks that would be available via a compromised CA? (I hope that came out right)

3

Plain DNSSEC

DNSSEC only secures DNS records, and on its own does not help at verifying certificates. This mitigates DNS hijacking (when some man in the middle, for example a network provider threatened by governments) returns faked DNS records.

It does not help against other attacks, especially redirecting the traffic (without spoofing the DNS records) or tampering the traffic in-between (and wrapping it in TLS again). In this case, an attacker could use a valid certificate issued by a compromised CA.

DANE

DANE uses special, DNSSEC-signed DNS records (TLSA-records) which declare what certificates are allowed for a domain. If you put together DNSSEC and DANE, it is possible to either declare self-signed certificates as trusted (verified against the DNSSEC trust hierarchy), or have a second validation path of CA-signed certificates.

The large disadvantage of DANE: implementation coverage is still very, very low; pretty much nobody is using (or even able to use) it at the time of this answer: Firefox and Chrome plugins are available, and Postfix has support for it.

  • My (granted limited) understanding is that DNSSEC reduces the risk of dns hijacking and that is one of the primary ways a compromised certificate would be used, ie redirecting user to another machine which then presents the compromised cert? – TrustNoOne Jan 3 '15 at 23:13
  • There are further attack vectors but changing DNS records, which could be prevented by DANE. If an attacker already is able to spoof DNS records, tampering with other contents isn't very far away any more. – Jens Erat Jan 3 '15 at 23:22
  • @JensErat, So in other words... DANE is CA done via DNSSEC? – Pacerier Feb 16 '15 at 19:53
  • To some extend: yes, and at the same time, no. It is a hierarchical CA system, but unlike the current system with a well-defined responsibility for each zone (the zone's "owner"). This also makes the system more observable and controllable: you can hardly roll out fake DNSSEC records for a large zone (like the root zone or a whole TLD), somebody would notice. – Jens Erat Feb 16 '15 at 23:07
1

In addition to Jens Erat's excellent answer, DNSSEC would not prevent IP Hijacking.

IP hijacking (sometimes referred to as BGP hijacking, prefix hijacking or route hijacking) is the illegitimate takeover of groups of IP addresses by corrupting Internet routing tables.

So this attack in combination with a compromised CA could lead to a website compromise of user data.

  • Hmm, IP Hijacking seems pretty hard to achieve for your typical non-government attacker. – Pacerier Feb 16 '15 at 19:55
  • The OP is called "TrustNoOne" ;) – SilverlightFox Feb 16 '15 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.