Chapter 8. Blockchain-Based DNS Security Platform

The Domain Name System (DNS) is mainly designed to resolve a host name query to an IP address. Internet users need to have domain names, such as www.packtpub.com, but the internet needs an IP address to route the request to the desired destination. This way, DNS becomes the phonebook of the internet and allows everyone to use it globally; however, this also leaves a high possibility of it getting misused. In this chapter, we will learn about the DNS infrastructure, the core components, challenges with the existing system, and how blockchain can transform its current functionality.

In this chapter, we will cover the following topics:

• DNS
• DNS structure and hierarchy
• DNS topology for large enterprises
• Challenges with the current DNS solution
• Blockchain-based DNS solution
• Labs

DNS

DNS is the heart of the internet. If DNS is unavailable, each one of us will have a hard time finding resources on the internet. Being a massive phonebook of the internet, our entire online system relies heavily on DNS. Because of DNS namespaces, none of us have to remember a list of IP addresses; instead, we just have to remember the names of web pages.

For IT and security professionals, it is important to understand the basic structure, function, and operations of DNA. It is a hierarchical database with delegated authority. As per the scope of this chapter, we will be consider enterprise DNS deployments and its functions. There are two ways organizations can manage their DNS infrastructures: by allowing their Internet Service Provider (ISP) to manage it or by managing it internally. Any configuration mistakes or failure in the ISP network can turndown the organization's internet infrastructure.

With the growing number of internet users, DNS became the backbone of organizations on the...

Understanding DNS components

The DNS is more than just a protocol, it consists of several independent entities working together to deliver a scalable and reliable domain name database. In its simplest form, there are three core components of the DNS: the namespace, server, and resolver.

Namespace

A namespace is a structure of the DNS database. It is represented in the form of an inverted tree with its root node at the top. Each node in the tree has a label and the root node has a null label. Take a look at the following diagram:

A domain name is the sequence of labels starting from a node to the root, separated by dots. The namespace can have a maximum depth of 127 levels and domain names can be of a size not more than 255 characters in length:

Name servers

Name servers are responsible for storing information about the namespace in the form of zones. There can be multiple name servers and ones that load a complete zone are said to be authoritative for the zone. Generally, there is more than one...

DNS structure and hierarchy 

Similar to the internet's DNS infrastructure, organizations also deploy their internal DNS infrastructures. To deploy an internal DNS infrastructure, organizations can select any domain hierarchy; however, once connected to the internet, they have to follow the common DNS framework . Let's understand the name server hierarchy.

Root name server

With consistent namespaces across the internet, the root name server directly responds to requests for records in the root zone and answers other requests by returning a list of the authoritative name servers for the appropriate TLD.

In order to modify the root zone, a zone file has first to be published over the internet. The root zone file is published on 13 servers from A to M across the internet.

The root zone contains the following information:

• Generic top-level domains such as .com, .net, and .org
• Globally recognized TLDs
• Country code TLDs,  two-letter codes for each country such as .in for India or .no for Norway
• Globally...

DNS topology for large enterprises

For IT professionals, understanding DNS queries and the types of name server takes us most of the way to organizational DNS best practices:

• Network topology: Redundancy plays a critical role in domain infrastructure. Even if one server fails, another takes control to keep the service up and running. BIND (widely used DNS software) supports high redundancy through a master-slave relationship. The master NS updates the change in mapping to one or more slave servers through the zone transfer mechanism.
• Configuration files: BIND's configuration is storedin a file callednamed.conf. This named.conf file helps the server to recognize the authoritative and/or caching server and whether it is the master or slave for any specific zone. The file points to zone files that contain the real mapping database. It contains lines or records that define name-to-address and address-to-name mapping for a specific domain.

Architecture

With the changing technology and network transformation...

Challenges with current DNS 

Today, DNS has become the backbone of the internet and organization's networks. The DNS is mission-critical infrastructure that no organization can function without. However, despite growing investment in network and information security, attackers still manage to invade the network, and the DNS remains a vulnerable component in the network infrastructure that is often used as an attack vector. Firewalls leave port 53 open and never look inside each query. Let's look at one of the most widely used DNS-based attacks:

DNS spoofing 

When a DNS server's records are altered to redirect the traffic to the attacker's server, the DNS gets hijacked. This redirection of traffic allows the attacker to spread malware across the network. DNS spoofing can be carried out in one of the following three ways:

• DNS cache poisoning: An attacker can take advantage of cached DNS records and can then perform spoofing by injecting a forged DNS entry into the DNS server. As a result, all...

Blockchain-based DNS solution

Blockchain technology has the capabilities to transform several industries and in this chapter, we are going to use it for managing a name server to overcome some of the most critical DNS challenges. DNSChain is one of the most active projects to transform the DNS framework and protect it from spoofing challenges.

DNSChain is a blockchain-based DNS software suite that replaces X.509 public key infrastructure (PKI) and delivers MITM proofs of authentication. It allows internet users to set a public DNSChain server for DNS queries and access that server with domains ending in .bit.

X.509 PKI replacement

X.509 is a standard framework that defines the format of PKI to identify users and entities over the internet. It helps internet users to know whether the connection to a specific website is secure or not. DNSChain has the capability to provide a scalable and decentralized replacement that doesn't depend on third parties.

MITM-proof DNS infrastructure

This uses a public...

Lab on Ethereum-based secure DNS infrastructure

DNS infrastructure has been the most targeted asset of organizations. Traditional DNS is vulnerable to several sophisticated threats. The current DNS system is hierarchical and the system root server becomes the high-value attack vector. Since the entire infrastructure is centralized, even a slight failure can lead to whole system failure. A group of engineers, Greg Siepak and Andrea Devers, have developed an Ethereum-based DNS platform to connect client and name server without any involvement of a third party in between. The project is named DNSChain and is hosted over GitHub at https://github.com/okTurtles/dnschain.

Lab preparation

Configure the DNSChain server in Ubuntu. It will run the PowerDNS Recursor, issuing DNS queries for .com and .net domains as you would expect, but consulting the local Namecoin blockchain to resolve .bit domains.

We will start with a fresh copy of Ubuntu LTS. In our lab, we will deploy this Ubuntu system over Amazon...

Summary

In this chapter, we learned about the DNS framework and its core components. We understood that any compromised DNS server can result in massive damage to infrastructure and how the blockchain can solve some of these critical challenges with its fundamental advantages.

Questions

The DNS is the backbone of the internet and also one of the most complex protocol frameworks. With every new attack vector, the DNS prepares itself to be stronger and more comprehensive. Readers can look up the following questions:

1. What is a DNS tunneling attack?
2. Can blockchain be used to deploy an entire DNS infrastructure, and if so, how?

Further reading

Read the following articles to find out more about DNS-OARC and ISC:

• Introduction to DNS-OARC at https://www.dns-oarc.net/
• ISC at http://www.isc.org