TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records

Olivier van der Toorn; Roland van Rijswijk-Deij; Tobias Fiebig; Martina Lindorfer; Anna  Sperotto

doi:10.1109/EuroSPW51379.2020.00080

TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records

Olivier van der Toorn, Roland van Rijswijk-Deij, Tobias Fiebig, Martina Lindorfer, Anna Sperotto

Design and Analysis of Communication Systems

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

5 Citations (Scopus)

119 Downloads (Pure)

Abstract

The DNS TXT resource record is the one with the most flexibility for its contents, as it is a largely unstructured. Although it might be the ideal basis for storing any form of text-based information, it also poses a security threat, as TXT records can also be used for malicious and unintended practices. Yet, TXT records are often overlooked in security research. In this paper, we present the first structured study of the uses of TXT records, with a specific focus on security implications. We are able to classify over 99.54% of all TXT records in our dataset, finding security issues including accidentally published private keys and exploit delivery attempts. We also report on our lessons learned during our large-scale, systematic analysis of TXT records.

Original language	English
Title of host publication	2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)
Place of Publication	Piscataway, NJ
Publisher	IEEE
Pages	544-549
Number of pages	6
ISBN (Electronic)	978-1-7281-8597-2
ISBN (Print)	978-1-7281-8598-9
DOIs	https://doi.org/10.1109/EuroSPW51379.2020.00080
Publication status	Published - Sep 2020
Event	5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020 - Genoa, Italy Duration: 7 Sep 2020 → 7 Sep 2020 Conference number: 5

Conference

Conference	5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020
Abbreviated title	WTMC
Country/Territory	Italy
City	Genoa
Period	7/09/20 → 7/09/20

Keywords

DNS
Security
Measurement
Classification
Cybersecurity

Access to Document

10.1109/EuroSPW51379.2020.00080

VanderToorn2020txtingAccepted author version, 514 KB

http://annasperotto.org/publication/papers/2020/toorn-wtmc-2020.pdf

Cite this

@inproceedings{b1d1e79ca1d746e2bcaca7955a64127e,

title = "TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records",

abstract = "The DNS TXT resource record is the one with the most flexibility for its contents, as it is a largely unstructured. Although it might be the ideal basis for storing any form of text-based information, it also poses a security threat, as TXT records can also be used for malicious and unintended practices. Yet, TXT records are often overlooked in security research. In this paper, we present the first structured study of the uses of TXT records, with a specific focus on security implications. We are able to classify over 99.54% of all TXT records in our dataset, finding security issues including accidentally published private keys and exploit delivery attempts. We also report on our lessons learned during our large-scale, systematic analysis of TXT records.",

keywords = "DNS, Security, Measurement, Classification, Cybersecurity",

author = "{van der Toorn}, Olivier and {van Rijswijk-Deij}, Roland and Tobias Fiebig and Martina Lindorfer and Anna Sperotto",

year = "2020",

month = sep,

doi = "10.1109/EuroSPW51379.2020.00080",

language = "English",

isbn = "978-1-7281-8598-9",

pages = "544--549",

booktitle = "2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)",

publisher = "IEEE",

note = "5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020, WTMC ; Conference date: 07-09-2020 Through 07-09-2020",

}

van der Toorn, O, van Rijswijk-Deij, R, Fiebig, T, Lindorfer, M & Sperotto, A 2020, TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records. in 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)., 9229819, IEEE, Piscataway, NJ, pp. 544-549, 5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020, Genoa, Italy, 7/09/20. https://doi.org/10.1109/EuroSPW51379.2020.00080

TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records. / van der Toorn, Olivier; van Rijswijk-Deij, Roland; Fiebig, Tobias et al.

2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). Piscataway, NJ : IEEE, 2020. p. 544-549 9229819.

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

TY - GEN

T1 - TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records

AU - van der Toorn, Olivier

AU - van Rijswijk-Deij, Roland

AU - Fiebig, Tobias

AU - Lindorfer, Martina

AU - Sperotto, Anna

N1 - Conference code: 5

PY - 2020/9

Y1 - 2020/9

N2 - The DNS TXT resource record is the one with the most flexibility for its contents, as it is a largely unstructured. Although it might be the ideal basis for storing any form of text-based information, it also poses a security threat, as TXT records can also be used for malicious and unintended practices. Yet, TXT records are often overlooked in security research. In this paper, we present the first structured study of the uses of TXT records, with a specific focus on security implications. We are able to classify over 99.54% of all TXT records in our dataset, finding security issues including accidentally published private keys and exploit delivery attempts. We also report on our lessons learned during our large-scale, systematic analysis of TXT records.

AB - The DNS TXT resource record is the one with the most flexibility for its contents, as it is a largely unstructured. Although it might be the ideal basis for storing any form of text-based information, it also poses a security threat, as TXT records can also be used for malicious and unintended practices. Yet, TXT records are often overlooked in security research. In this paper, we present the first structured study of the uses of TXT records, with a specific focus on security implications. We are able to classify over 99.54% of all TXT records in our dataset, finding security issues including accidentally published private keys and exploit delivery attempts. We also report on our lessons learned during our large-scale, systematic analysis of TXT records.

KW - DNS

KW - Security

KW - Measurement

KW - Classification

KW - Cybersecurity

U2 - 10.1109/EuroSPW51379.2020.00080

DO - 10.1109/EuroSPW51379.2020.00080

M3 - Conference contribution

SN - 978-1-7281-8598-9

SP - 544

EP - 549

BT - 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)

PB - IEEE

CY - Piscataway, NJ

T2 - 5th International Workshop on Traffic Measurements for Cybersecurity, WTMC 2020

Y2 - 7 September 2020 through 7 September 2020

ER -

TXTing 101: Finding Security Issues in the Long Tail of DNS TXT Records

Abstract

Conference

Keywords

Access to Document

Fingerprint

Cite this