[Music]
morning everybody uh thanks for coming
here uh I am going to give a
presentation on using DNS as a security
tool I know we we love to blame it for
all of our problems but sometimes you
can actually fix some of
them uh so just to give you a little
introduction of who I am yes that's me
uh the stute in the crowd will notice
that's a Commodore 64 it's about
1985 uh so I've been I've been doing
computer stuff for a pretty long time uh
family got a first uh home computer in
like ' 89 it was a wonderful Packard
Bell I'm sure you remember some of that
and I got a hand me down about two years
later from my grandfather he's the one
who got me started in this uh My First
Security incident was in 1999 we busted
a credit card Security fraud ring um and
that was on an e-commerce site that was
that was some good times that was a lot
of fun uh my boss at the time he
he really enjoyed finding those people
and he would ask them what they would
want on their pizza and then send a
pizza to their house because he he
really like to jerk their chain a little
bit it was fun uh I've had a long
history and Technical Support uh I've
worked at pgp and RSA uh spent time at
microfocus which I'm guessing probably a
quarter of this room has at some point
uh it's kind of a write a passage in
this state uh right now I'm a senior
infosec engineer at Dental intelligence
their ass sass off company based out of
Pleasant Grove uh I wear a lot of hats
there uh mostly doing vulnerability
management and security architecture
right
now so I'll tell you what this talk
isn't just to get that out of the way
I'm not going to do real deep dive on
technical details and there's a reason
for that one it'll be super dry and
boring and two there's probably like two
of you who would actually write down all
the notes to do that you're going to go
Google this anyway so I want you to
understand the concepts and that some of
this stuff exists so that you'll go back
to day job and say all right I remember
that thing that guy talked about I'm
going to go search for it and go and do
it this is also so that you always have
the most up-to-date information on how
to do it because stuff changes real
fast so I just want to make sure that
your expectations are set here what
we're doing
here so there are a lot of different
kinds of DNS records out there there's
actually no less than 48 different types
of them uh odds are quite good you're
not going to use more than about a
handful of them so you don't need to be
staring down cthulu and rolling your
sanity uh the most important root one
there is the SOA or start of authority
record that's kind of your root record
that says hey this is this is where my
DNS uh servers are located this is
telling me um you know all the
information to Stage it um it and DNS is
organized in what they call zones so if
you think about example.com example.com
is a Zone but Comm is also a Zone it
happens to be a root
Zone this is really
important um to establish the authority
you know you can establish what DNS
servers are responsible for each Zone
there's a lot of other stuff going on
there but that's the important security
part you're saying these are the servers
that'll actually have information you
need you'll also have NS or name server
records that reiterate the primary DNS
server that are responsible as any
secondary servers this is important
because you can use this to control
who's allowed to get a copy of all your
DNS records uh that's that is an
important security function
there so these are kind of your your
core of DNS security is making sure you
have a good start of authority you have
good name server records you want to
make sure you're clamping down of who
can do a Zone transfer who can say hey
give me all your records because you
don't want to necessarily disclose those
um DNS set can sometimes help there
we'll we'll cover that a little later
the main records you're probably going
to be using on a day-to-day basis are A
and C Name Records the a pretty pretty
straightforward here's the name and
here's the IP address it goes to and if
you're fancy and you're using IPv6 you
might have some quad records in there
that are telling you where the IPv6
address is for
this
um important to not C names is that they
are great aliases like to say hey when
you want to talk to this fully qualified
domain name you should actually go talk
to that one over there uh they're used a
whole lot so for example you could have
www.example.com
to webserver one. example.com or it
could be even more complicated like
having user portal. example.com pointing
to a domain on Azure and text Bas
records are ones that you're going to
use a lot for security purposes uh these
are pretty free form uh people will
Define if I see something with this
format then I know how I'm going to
parse it uh
there's uh there's a lot of rfc's out
there um and the text records have
proven to be a quick way to scaffold up
a solution without having to necessarily
go create yet another DNS record and
since we've already got 48 of them I
imagine we're not super eager to have
more so one of the foundational failures
of email is I've never bothered to
validate who's actually sending a
message out um and that wasn't a big
deal back in the days of the arpanet
where everybody knew every single node
on the system and you know spam wasn't
an issue uh quickly Came Crashing Down
to to Earth um your spam folder will
certainly attest to that being a problem
so there were early anti-spam efforts
like spam house that said well we'll
just find the bad servers and we'll just
start blocking them uh has anyone gotten
on a Spam house block list before you
you know exactly how painful that is you
can't get off of it to save your life um
and so it was a great idea but a lot of
people end up getting caught in the
crossfire a lot of legitimate email just
gets thrown in the bin um and it was
mainly because there was wasn't any good
system back when they started doing it
in like the late '90s early
2000s now of course one of the problems
with the Internet is you can never
introduce any sort of breaking change
you know when IPv6 was proposed right
like over two decades ago is anyone here
using IPv6 on a regular
basis no no we're not because it changes
so much stuff and so we had to figure
out a way to stop spam without going and
changing everything in smt PP so of
course naturally we're going to start
using DNS to do this so SPF was the
first thing that came to the rescue and
the idea is hey let's have a formatted
DNS text record that says here is who is
allowed to send email on behalf of this
domain uh the record kind of looks
cryptic when you first look at it but
it's fairly
straightforward uh structure the text
record says V equals spf1 saying this is
version spf1 there is no verion two they
just wanted to be Forward Thinking in
case they had to made make one and they
have not done so yet so it's fairly
simple to break down what's happening
here you will have plus to say this is
who's allowed to send you will have
negative to say here's who's explicitly
disallowed to send you'll notice there's
a record up there with a Tilda in front
of it and that's to say I want you to
soft fail this which and in this record
we have soft fail anything I haven't
mentioned yet now you ask yourself why
would I want a soft fail instead of hard
fail anything that's not my mail server
well the problem is is remailer Services
um you will find sometimes that you will
go and fill out a support form and it
says oh well I'm going to send email you
it looks like it's coming from you and
then it goes to your junk folder and you
don't ever get it it's a horrible
practice I hate that people do it but
soft fail is kind of a good safety step
there to make sure that you aren't
throwing all sorts of stuff in your junk
folder that you don't NE necessarily
want to have there so this record is
saying we say plus MX like you see an MX
record that's saying this is a mail
server for this domain yeah obviously I
want to send mail from that plus a if
you see an a record for this domain yes
obviously any a record should probably
be allowed to send mail on behalf of
this if and then we have explicitly an
ipv4 address that's allowed to send so
the way it parses is you'll put your
allows and your disallows and then at
the end you'll have the all record
either and you'll probably always have a
soft fail or fail if you don't have an
allow for all then You' you've lost the
plot you are not knowing what you're
doing with SPF records please don't do
that it will be a problem um if you're
looking for a good reference on SPF
record creation uh Dem Maran is a
service out there that uh has really
good references they also have been
offer a nice free tier to be able to see
issues with your SPF and uh dmark and
dkm
Records now SPF solves one problem which
is we know which mail servers are
supposed to send mail what it doesn't
solve is the problem of is anyone
messing with the message when it goes
out if you know anything about how email
works it's not a straight my mail server
talks to the recipient mail server and
we're done it bounces around through
other mail servers now of course the
problem there is email is all plain text
and now you could be using pgp to
encrypt the contents but the headers
could still be messed with
right and so that creates a fundamental
problem of we want to ensure message
integrity and so we have dkam that's
thrown in the mix here and in this case
we're using the mail server to
cryptographically sign yes I am the male
server that actually sent this message
so no one can tamper with it tamper with
the headers in in process so that one is
pretty important um in conjunction with
that you want to have a DeMark policy a
DeMark policy is saying if for some
reason there's a message that fails dkam
or fails SPF tell this email address
about it tell it what's going on these
have become requirements Google recently
announced that if you do not have SPF
dkm and dmart records and you're sending
more than 5,000 messages a month they're
going to throw you right in the trash
bin so it's very important to have this
set up now de one thing to note about
the DeMark reports is that they're XML
files does anyone here actually read XML
files by
hand no no we do not we want to send
them to a machine readable format there
are Services out there I mentioned Dem
Maran before they have a free tier for
up to two domains you can send them
there it's great to do on a personal
domain just to see hey here's what's
happening I actually found there were
people who are trying to send junk
messages on some of my domains um they
learn very quickly that's not going to
fly uh so these screenshots kind give
you an idea of some of the reporting
that does uh you can see the DeMark
record on the top again V equals D Mark
1 there's only one version but they
still wanted to make sure and so in this
case we're saying a policy in this case
the reject policy and where we are going
to send those
reports so let's be honest here when
you're surfing around internal resources
on your corporate Network how many times
are you seeing this not secure warning
because you have self- sign certificates
everywhere
every single one of you should be
cringing at that um and I get it because
the process of issuing installing and
maintaining a fleet asserts kind of
sucks uh there's it's something that is
not a lot of fun um DNS though does play
an integral part in making sure that you
can get this done uh the first thing
being that you need to have a valid
domain name that's pointing to the
resource because the certificate is
issued against the domain name you can
issue against an IP as a subject
alternative name but you can't issue it
as a subject that that doesn't apply um
and I'm sure most of you have heard of
let's encrypt let's encrypt uses can use
DNS for verification it has two main
verification types HTTP where it reaches
out over HTTP and says hey can you
validate you control the system and the
other one is using DNS uh with DNS it
creates a temporary text record it
validates that you have in fact control
of the DNS records for that domain and
send you upon your Merry way um and so
DNS is extremely important to make sure
that that works properly uh a great
thing is that you can use let's encrypt
to issue Sears on your internal network
using DNS challenges and nothing has to
be able to reach into your network to do
it it's
fantastic um so I I highly recommend
thinking about doing something like that
uh it and so uh you know that'll that'll
help because the fewer of These Warnings
you have on your local Network the more
These Warnings will stand out as hey
something's not right
here now does anyone here remember that
sanch had a business doing
certificates emphasis is on the word
had so uh they had issued over 30,000
certificates to people who did not own
the respective domains and that's why it
is a past tense uh if you're a
certificate Authority that's that's
pretty much a death nail right there
pretty much all of the browser vendor
said
okay semantic we are not going to trust
you in our browsers anymore you're dead
to us everyone's going to distrust you
uh so they ended up selling the business
it was a huge Fiasco for them so DNS can
solve some of this miss m Mis issuance
problem there's a special type of record
called a CAA record and this allows you
to list which certificate issuers are
allowed for any given domain so this is
really handy so if you're using diger
you know that every single certificate
you're issuing is is coming from ditch
assert you can create a CA record for
that and if if someone tries to issue un
let en Crypt it goes whoa no no we're
not doing that it also gives you a nice
security control so that a browser can
check a CA record and say hold on a
minute you're this example.com shouldn't
be using let en Crypt we're going to
throw that right
out uh it also allows you to sorry hit
the wrong button there it allows you to
specify that you uh allow certain domain
certain issuers to issue wild cards and
certain issuers to not so you can really
cramp down on whether or not you want a
on who you want to be able to allow to
issue certificates and you can tell it
borrows a lot of Concepts from SPF and
dkim to be able to say yes we're doing
this is who's allowed and this is who
not now obviously you can see a problem
here that if you are using let's encrypt
and you make that your ca record well
now any Yahoo using let encrypt can do
that so that's not a really good
solution if you're do using one of those
free services but if you're using a a
different CA that can help you really
clamp
down so you can dodge a lot of bullets
too with DNS filtering uh this is
another great security tool of DNS I'm
sure most of you have heard of py
hole Yeah Yeah running that at home it's
it's a lifesaver yeah usually you're
thinking of it of oh I'm blocking all
those obnoxious ads that that pop up all
over the place um but ad networks are
threat vectors aren't they
like Google just recently had a problem
where they were Distributing mware in
their ad Network again as they're trying
to get you to watch their ads on YouTube
a little bit of a mixed message there
isn't
it so it's great for ad filtering but
it's also great for blocking security
threats you can block things such as
known fishing domains uh a favorite of
mine is to block newly created domains
anything less than 30 days old because
nine times out of 10 they're used for
something malicious although one of my
favorites is catching people who are
going out and registering domains in
your company without using the official
registar and then they create a ticket
and say hey why is my newly registered
domain not working you're like oh okay
you went over to GoDaddy and you're
supposed to be using our you know
official
registar right to jail right away so you
can filter out things like command and
control domain smallware
distribution uh now I will say that py
hole isn't necessarily intended to be a
commercial solution you can use it that
way in a smaller office and it'll work
build are perfectly fine um but there
are a lot of um a lot of commercial
options out there uh Cisco umbrella
infolock blocks one threat defense Cloud
flare zero trust open
DNS tons of services out there uh and
many of them are hosted services so that
pretty much all you need to do is say
here's where I'm going to forward from
my internal DNS servers and you call it
a day there's no infrastructure to set
up from there uh your internal DNS
servers can do filtering too um
Unbound can can take a block list uh
believe bind can also take block lists
so if you want to roll your own you
absolutely can do that uh but there's a
lot of great Solutions out there and
this is something where it is super
lightweight like users don't even notice
the impact because there's nothing
running on their systems um great way to
be able to use DNS as a security
tool now I'm going to talk a little bit
about DNS SEC has anyone here bothered
to look into DNS sec or implement
it you hate it right it's terrible it's
awful the ideas were great um but kind
of like IPv6 it came down to
implementation time and I was like well
this sucks because it was designed um to
use spherical chickens in a
vacuum so the idea behind dnsx is adding
cryptographic signatures to your DNS
records so that you know that the zone
is signed and all DNS records are
correct it's it's got full Integrity
that sounds pretty cool right like
you're saying yeah I've signed it all my
records are cool there's no DNS spoofing
there's no man in the middle I'm secure
except the setup is really terrible and
you're going to hate terms that come out
of my mouth if you've ever heard
something like key signing key that that
should make that should make your gut
twist
up so first you need a key to sign your
Zone and this is fairly straightforward
you grab the set of records from your
Zone you sign the entire Zone spit out a
signal you publish the public key so it
can be validated but now you need to
also sign the Zone key Zone signing key
oh uh oh oh no we're getting into
multiple keys aren't we in Key
Management so we add another key the key
signing key which signs the Zone signing
key and you publish the public card of
the key signing key don't worry it only
gets worse from
here so your domain like Bobs awesom
widget.com doesn't exist in a vacuum
does it you remember I talked about
zones right it has a parent domain Comm
next now you have to drag the parent
into it to do additional signing and
that parent is also signed by a special
root signing key that's used in a key
signing ceremony I swear I'm not making
this up for seven people who each hold a
piece of the key assemble to do the
needful I know this sounds absolutely
Bonkers but this is actually how it
works if all this signing business
wasn't enough to put you off DNS SEC
also has a problem with subdomain
enumeration now remember I said you sign
the whole zone right now and if you
don't have DNS SEC does anyone get a
full copy of your DNS records no not
unless you said they can do a Zone
transfer but you have to sign the entire
Zone in DNS SEC and publish the entire
Zone and so all of a sudden all your DNS
records are out there for the world to
see that might be a little bit of a
security risk for you if you don't want
people to necessarily know that it's
there I know security through oburity
sucks and blah blah blah but it's still
not a bad thing to
have so that might give an attack attack
or a Hit List uh now there's some
mitigations for it but it is a
workaround it requires very careful
planning in your
implementation and I know there's
there's probably a lot of you out there
who like me have had experience working
with
cryptography and you're you're starting
to think wait a minute you've got keys
here now how long are Keys good for not
forever is the is the answer which means
that you have to start rotating those
keys and so that you will end up with
having to use key man to rotate these
keys out and now you're talking about an
HSM which nobody wants to have to deal
with so you also can issue have some
problems with DNS amplification attacks
which are way worse with DNS SEC so the
short of DNS SEC is that yes you can get
all sorts of additional Integrity but
there are a lot of dragons here and it's
usually that dragon on the
right thanks for coming here I will
certainly open up the floor to any
questions comments or rude noises that
you may
[Applause]
have