ICANN DNS 研讨会 | 2022年11月


In this paper, we propose Phoenix Domain, a general and novel attack that allows adversaries to maintain the revoked malicious domain continuously resolvable at scale, which enables an old, mitigated attack, Ghost Domain. Phoenix Domain has two variations and affects all mainstream DNS software and public DNS resolvers overall because it does not violate any DNS specifications and best security practices. The attack is made possible through systematically “reverse engineer” the cache operations of 8 DNS implementations, and new attack surfaces are revealed in the domain name delegation processes. We select 41 well-known public DNS resolvers and prove that all surveyed DNS services are vulnerable to Phoenix Domain, including Google Public DNS and Cloudflare DNS. Extensive measurement studies are performed with 210k stable and distributed DNS recursive resolvers, and results show that even after one month from domain name revocation and cache expiration, more than 25% of recursive resolvers can still resolve it. The proposed attack provides an opportunity for adversaries to evade the security practices of malicious domain take-down. We have reported discovered vulnerabilities to all affected vendors and suggested 6 types of mitigation approaches to them. Until now, 7 DNS software providers and 15 resolver vendors, including BIND, Unbound, Google, and Cloudflare, have confirmed the vulnerabilities, and some of them are implementing and publishing mitigation patches according to our suggestions. In addition, 9 CVE numbers have been assigned. The study calls for standardization to address the issue of how to revoke domain names securely and maintain cache consistency.

11月 15, 2022 9:00 AM — 11月 16, 2022 4:45 PM
Brussels Marriott Hotel Grand Place
Rue Auguste Orts 3-7, Brussels, 1000

在2022年第五届ICANN的DNS研讨会(IDS 2022)中,我分享了NDSS ‘23论文不死域名,反响热烈。


李想,清华大学网络科学与网络空间研究院四年级博士研究生,导师为李琦副教授和段海新教授。他是网络与系信息安全实验室(NISL)的成员之一,也是奇安信公司的安全研究实习生。目前他作为访问学者在加州大学尔湾分校李洲助理教授研究组进行学术交流。此外,他也是一款开源网络扫描器XMap的开发者与维护者。研究领域涉及网络安全、协议安全、IPv6安全、DNS安全、互联网测量以及网络协议fuzzing。作为第一作者,他目前在网络安全顶级会议发表论文3篇,涵盖USENIX Security、NDSS、DSN。作为合作作者,他也在网络顶级会议发表多篇论文,如USENIX Security和SIGMETRICS。此外,他在工业界顶级安全会议也进行过演讲,如Black Hat。他经常参加相关会议讨论分享最近的研究进展,如IDS、OARC、VehicleSec。在漏洞挖掘领域,他目前已发现多个IPv6和DNS方向的新型重大漏洞并获得140+安全漏洞编号(CVE/CNVD),其中所发现的IPv6漏洞影响了数十家路由器厂商。他也发现了DNS协议设计和实现层面的漏洞,影响了所有DNS的软件和实现。目前他已经获得了多家知名互联网厂商的致谢和奖励(超过$10.6k),包括谷歌、微软、Cloudflare、Akamai等公司,并在积极推进DNS等协议标准的改进(相关工作已被纳入RFC文档)。