The Forgotten Side of DNS: Orphan and Abandoned Records

Raffaele  Sommese; Mattijs  Jonker; Roland van Rijswijk-Deij; Alberto Dainotti; K.C. Claffy; Anna  Sperotto

doi:10.1109/EuroSPW51379.2020.00079

The Forgotten Side of DNS: Orphan and Abandoned Records

Raffaele Sommese, Mattijs Jonker, Roland van Rijswijk-Deij, Alberto Dainotti, K.C. Claffy, Anna Sperotto

Design and Analysis of Communication Systems

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

5 Citations (Scopus)

199 Downloads (Pure)

Abstract

DNS zone administration is a complex task involving manual work and several entities and can therefore result in misconfigurations. Orphan records are one of these misconfigurations, in which a glue record for a delegation that does not exist anymore is forgotten in the zone file. Orphan records are a security hazard to third-party domains that have these records in their delegation, as an attacker may easily hijack such domains by registering the domain associated with the orphan. The goal of this paper is to quantify this misconfiguration, extending previous work by Kalafut et al., by identifying a new type of glue record misconfiguration – which we refer to as abandoned records – and by performing a broader characterization. Our results highlight how the situation has changed, not always for the better, compared to a decade-old study.

Original language	English
Title of host publication	2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)
Place of Publication	Piscataway, NJ
Publisher	IEEE
Pages	538-543
Number of pages	6
ISBN (Electronic)	978-1-7281-8597-2
ISBN (Print)	978-1-7281-8597-2, 978-1-7281-8598-9
DOIs	https://doi.org/10.1109/EuroSPW51379.2020.00079
Publication status	Published - Sept 2020
Event	5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020 - Genoa, Italy Duration: 7 Sept 2020 → 7 Sept 2020 Conference number: 5

Publication series

Name	Proceedings - 5th IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2020

Conference

Conference	5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020
Abbreviated title	WTMC
Country/Territory	Italy
City	Genoa
Period	7/09/20 → 7/09/20

Keywords

DNS
Orphan records
Abandoned records
Misconfiguration
Cybersecurity
22/3 OA procedure

Access to Document

10.1109/EuroSPW51379.2020.00079

Sommese2020forgottenFinal published version, 145 KBLicence: Taverne

Cite this

Sommese, R., Jonker, M., van Rijswijk-Deij, R., Dainotti, A., Claffy, K. C., & Sperotto, A. (2020). The Forgotten Side of DNS: Orphan and Abandoned Records. In 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) (pp. 538-543). Article 9229781 (Proceedings - 5th IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2020). IEEE. https://doi.org/10.1109/EuroSPW51379.2020.00079

@inproceedings{b2bb0817693f4eda9a6e762e9cedba6f,

title = "The Forgotten Side of DNS: Orphan and Abandoned Records",

abstract = "DNS zone administration is a complex task involving manual work and several entities and can therefore result in misconfigurations. Orphan records are one of these misconfigurations, in which a glue record for a delegation that does not exist anymore is forgotten in the zone file. Orphan records are a security hazard to third-party domains that have these records in their delegation, as an attacker may easily hijack such domains by registering the domain associated with the orphan. The goal of this paper is to quantify this misconfiguration, extending previous work by Kalafut et al., by identifying a new type of glue record misconfiguration – which we refer to as abandoned records – and by performing a broader characterization. Our results highlight how the situation has changed, not always for the better, compared to a decade-old study.",

keywords = "DNS, Orphan records, Abandoned records, Misconfiguration, Cybersecurity, 22/3 OA procedure",

author = "Raffaele Sommese and Mattijs Jonker and {van Rijswijk-Deij}, Roland and Alberto Dainotti and K.C. Claffy and Anna Sperotto",

year = "2020",

month = sep,

doi = "10.1109/EuroSPW51379.2020.00079",

language = "English",

isbn = "978-1-7281-8597-2",

series = "Proceedings - 5th IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2020",

publisher = "IEEE",

pages = "538--543",

booktitle = "2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)",

address = "United States",

note = "5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020, WTMC ; Conference date: 07-09-2020 Through 07-09-2020",

}

Sommese, R , Jonker, M , van Rijswijk-Deij, R, Dainotti, A, Claffy, KC & Sperotto, A 2020, The Forgotten Side of DNS: Orphan and Abandoned Records. in 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)., 9229781, Proceedings - 5th IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2020, IEEE, Piscataway, NJ, pp. 538-543, 5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020, Genoa, Italy, 7/09/20. https://doi.org/10.1109/EuroSPW51379.2020.00079

The Forgotten Side of DNS: Orphan and Abandoned Records. / Sommese, Raffaele ; Jonker, Mattijs ; van Rijswijk-Deij, Roland et al.
2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). Piscataway, NJ: IEEE, 2020. p. 538-543 9229781 (Proceedings - 5th IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2020).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - The Forgotten Side of DNS

T2 - 5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020

AU - Sommese, Raffaele

AU - Jonker, Mattijs

AU - van Rijswijk-Deij, Roland

AU - Dainotti, Alberto

AU - Claffy, K.C.

AU - Sperotto, Anna

N1 - Conference code: 5

PY - 2020/9

Y1 - 2020/9

N2 - DNS zone administration is a complex task involving manual work and several entities and can therefore result in misconfigurations. Orphan records are one of these misconfigurations, in which a glue record for a delegation that does not exist anymore is forgotten in the zone file. Orphan records are a security hazard to third-party domains that have these records in their delegation, as an attacker may easily hijack such domains by registering the domain associated with the orphan. The goal of this paper is to quantify this misconfiguration, extending previous work by Kalafut et al., by identifying a new type of glue record misconfiguration – which we refer to as abandoned records – and by performing a broader characterization. Our results highlight how the situation has changed, not always for the better, compared to a decade-old study.

AB - DNS zone administration is a complex task involving manual work and several entities and can therefore result in misconfigurations. Orphan records are one of these misconfigurations, in which a glue record for a delegation that does not exist anymore is forgotten in the zone file. Orphan records are a security hazard to third-party domains that have these records in their delegation, as an attacker may easily hijack such domains by registering the domain associated with the orphan. The goal of this paper is to quantify this misconfiguration, extending previous work by Kalafut et al., by identifying a new type of glue record misconfiguration – which we refer to as abandoned records – and by performing a broader characterization. Our results highlight how the situation has changed, not always for the better, compared to a decade-old study.

KW - DNS

KW - Orphan records

KW - Abandoned records

KW - Misconfiguration

KW - Cybersecurity

KW - 22/3 OA procedure

UR - http://www.scopus.com/inward/record.url?scp=85097101206&partnerID=8YFLogxK

U2 - 10.1109/EuroSPW51379.2020.00079

DO - 10.1109/EuroSPW51379.2020.00079

M3 - Conference contribution

SN - 978-1-7281-8597-2

SN - 978-1-7281-8598-9

T3 - Proceedings - 5th IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2020

SP - 538

EP - 543

BT - 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)

PB - IEEE

CY - Piscataway, NJ

Y2 - 7 September 2020 through 7 September 2020

ER -

Sommese R , Jonker M , van Rijswijk-Deij R, Dainotti A, Claffy KC, Sperotto A. The Forgotten Side of DNS: Orphan and Abandoned Records. In 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). Piscataway, NJ: IEEE. 2020. p. 538-543. 9229781. (Proceedings - 5th IEEE European Symposium on Security and Privacy Workshops, Euro S and PW 2020). doi: 10.1109/EuroSPW51379.2020.00079

The Forgotten Side of DNS: Orphan and Abandoned Records

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this