互联网如何躲过一劫：KeyTrap 针对 DNSSEC 的拒绝服务攻击.pdf

1、#BHEU BlackHatEventsHowHow thethe Internet Internet DodgedDodged a Bullet:The a Bullet:The KeyTrapKeyTrapDenialDenial-ofof-Service Service AttacksAttacks againstagainst DNSSECDNSSECSpeaker(s):Elias Heftrig,Niklas VogelContributors:Haya Schulmann,Michael Waidner#BHEU BlackHatEventsRefresher:DNS and D

2、NSSEC#BHEU BlackHatEventsInformation Classification:GeneralWhy is it always DNS?#BHEU BlackHatEventsInformation Classification:GeneralWhy is it always DNS?DNSHTTPSSMTPFTPVoIPVPNNTPSignal.#BHEU BlackHatEventsInformation Classification:General.ing.bank.ing.www.bank.ing.IN A?bank.ing.IN NS ns.bank.ing.

3、12345678www.bank.ing.IN A 1.2.3.4DNS Resolution#BHEU BlackHatEventsInformation Classification:General.ing.bank.ing.www.bank.ing.IN A 6.6.6.6 Attack on DNS Record AuthenticityDNS Poisoningwww.bank.ing.IN A?www.bank.ing.IN A 6.6.6.6#BHEU BlackHatEventsInformation Classification:General.ing.bank.ing.At

4、tack preventedDNSSEC to the Rescue!Xwww.bank.ing.IN A?www.bank.ing.IN A 1.2.3.4www.bank.ing.IN A 6.6.6.6#BHEU BlackHatEventsInformation Classification:GeneralDNSSEC Adoption on the InternetAdoption in domains is dragging#BHEU BlackHatEventsInformation Classification:GeneralDNSSEC Adoption on the Int

5、ernetBetter adoption in Resolvers#BHEU BlackHatEventsInformation Classification:GeneralHow DNSSEC Validation WorksWhat is the IP Address ofwww.ietf.org?$dig www.ietf.org-t A+dnssec#BHEU BlackHatEventsInformation Classification:GeneralHow DNSSEC Validation WorksWhat is the IP Address ofwww.ietf.org?$

6、dig www.ietf.org-t A+dnssec;ANSWER SECTION:www.ietf.org.300 IN A 104.16.45.99www.ietf.org.300 IN A 104.16.44.99www.ietf.org.300 IN RRSIG A 13 3 300 20241211 20241209 34505 ietf.org.eSTHK9qluvSgBA=#BHEU BlackHatEventsInformation Classification:GeneralHow DNSSEC Validation WorksWhat is the IP Address