论文标题
whac-a-mole：六年的DNS欺骗
Whac-A-Mole: Six Years of DNS Spoofing
论文作者
论文摘要
DNS在互联网上几乎所有互动中都很重要。所有大型DNS操作员都使用IP Anycast，从多个物理位置宣布BGP中的服务器，以减少客户端潜伏期并提供容量。但是，DNS很容易被欺骗：第三方拦截并响应出于良性或恶意目的的查询。欺骗是使用Anycast的服务特别风险，因为服务已经从多个起源宣布。在本文中，我们描述了识别DNS欺骗，推断所使用的机制的方法，并确定从历史数据中欺骗的组织。我们的方法检测出明显的欺骗和一些隐秘的答案，尽管非常勤奋的对抗性欺骗者可以隐藏。我们使用这些方法从数千个有利位置研究有关根DNS服务器的六年以上数据。我们表明，今天的欺骗是很少见的，仅发生约1.7％的观察结果。但是，DNS欺骗的速度在不到七年的时间内增加了一倍以上，并且发生在全球。最后，我们使用来自BROOT DNS的数据来验证我们的欺骗检测方法，显示出超过0.96的真实率。 B根证实，DNS注入和代理都会发生欺骗，但是代理几乎解释了我们看到的所有欺骗。
DNS is important in nearly all interactions on the Internet. All large DNS operators use IP anycast, announcing servers in BGP from multiple physical locations to reduce client latency and provide capacity. However, DNS is easy to spoof: third parties intercept and respond to queries for benign or malicious purposes. Spoofing is of particular risk for services using anycast, since service is already announced from multiple origins. In this paper, we describe methods to identify DNS spoofing, infer the mechanism being used, and identify organizations that spoof from historical data. Our methods detect overt spoofing and some covertly-delayed answers, although a very diligent adversarial spoofer can hide. We use these methods to study more than six years of data about root DNS servers from thousands of vantage points. We show that spoofing today is rare, occurring only in about 1.7% of observations. However, the rate of DNS spoofing has more than doubled in less than seven years, and it occurs globally. Finally, we use data from B-Root DNS to validate our methods for spoof detection, showing a true positive rate over 0.96. B-Root confirms that spoofing occurs with both DNS injection and proxies, but proxies account for nearly all spoofing we see.
