Where Are You Taking Me? Behavioral Analysis of Open DNS Resolvers
Where Are You Taking Me? Behavioral Analysis of Open DNS Resolvers
复制标题
DOI：
10.1109/dsn.2019.00057
复制
发表时间：
2019-06
期刊：
影响因子：
--
通讯作者：
Jeman Park;Aminollah Khormali;Manar Mohaisen;Aziz Mohaisen
中科院分区：
文献类型：
--
作者：
Jeman Park;Aminollah Khormali;Manar Mohaisen;Aziz Mohaisen
开放 DNS 解析器是代表任何用户执行递归解析的解析器。它们可能被对手利用，因为它们向公众开放并且不需要授权即可使用。因此，了解开放解析器的状态以评估它们对互联网安全性和稳定性的潜在负面影响非常重要。在这项研究中，我们对整个IPv4地址空间进行了全面的探测，发现仍然存在超过300万个开放解析器。此外，我们发现其中许多的工作方式偏离了标准。更重要的是，我们发现许多开放解析器以错误甚至恶意的响应来回答查询。与 2013 年的结果相比，我们发现，虽然开放解析器的数量大幅减少，但提供错误响应的解析器数量几乎相同，而提供恶意响应的开放解析器的数量却有所增加，凸显了其威胁的普遍性。
Open DNS resolvers are resolvers that perform recursive resolution on behalf of any user. They can be exploited by adversaries because they are open to the public and require no authorization to use. Therefore, it is important to understand the state of open resolvers to gauge their potentially negative impact on the security and stability of the Internet. In this study, we conducted a comprehensive probing over the entire IPv4 address space and found that more than 3 million open resolvers still exist in the wild. Moreover, we found that many of them work in a way that deviates from the standard. More importantly, we found that many open resolvers answer queries with the incorrect, even malicious, responses. Contrasting to results obtained in 2013, we found that while the number of open resolvers has decreased significantly, the number of resolvers providing incorrect responses is almost the same, while the number of open resolvers providing malicious responses has increased, highlighting the prevalence of their threat.