DNS security
How DNS works
DNS hijacking
Short-circuiting waiting
Cache poisoning 2
Defenses
Cache poisoning 3
Cache poisoning 4
Being faster is not enough
Hijacking with sniffing
Hijacking with guessing
ARP vs DNS hijacking
Defenses
DNSSEC
DNSSEC Deployment Statistics
DNSSEC Hijacking Case Studies

DNSSEC

Auth stores two more record types RRSIG – signature for each A record DNSKEY – public key to verify the signature Auth inserts one record into parent in DNS hierarchy DS – says who is authoritative for a given subdomain and gives a hash of the public key (DNSKEY of auth) Resolver sets a bit asking for DNSSEC replies Verifies each DNSKEY using DS from the level higher in hierarchy Verifies RRSIG of the record