DNS???????????????

1
DNS???????????????

• ???
• ?????????
• jscheng_at_mail.stu.edu.tw 92.10.23

2
OUTLINE

• ???????
• ???????
• ?????????
• ????
• ??????
• ??????
• ??????????
• DNS?????
• DNS???????
• ??DNS????
• ???DNS????
• DNS????

3
OUTLINE

• DNS??????
• ???DNS????
• ???????
• ????
• ???????(User Certificate Interface)
• NSE(Nessus Scan Engine)
• NASL(Nessus Attack Script Language)
• Scan Result DateBase
• ????
• DNS??????
• ???????
• ????????
• ????
• ????

4
OUTLINE

• ???????
• ??DNS??????
• DNS??????
• DNS??????
• DNS????
• ??????
• ?????
• ??????
• DNS??????
• DNS????
• ??
• ??
• ??????

5
???????
6
???????

• DNS???20?????
• DNS????????
• ???DNS???????
• ??DNS??????????????

7
???????
8
?????????

• ??
• ??????????????
• DNS????????
• ??
• ???DNS???????????
• DNS??????
• ??????

9
????
10
??????http//www.find.org.tw/0105/howmany/index.a
sphttp//www.twnic.net/total/total_01.htm
2000? 2001? ???
???? 7.2 Gbps 14.8Gbps 105
?????? 343?? 392?? 14
??????? 114?? 210?? 85
TANET??? 291?? 344?? 18
??????? 44.4 61.6 17.2
11
??????
????CERT/CC(http//www.cert.org)2003.02
12
??????????
???? ???? ???? ???? ??????? ?????
Nmap ?? Win/Unix ?? ? ?
Saint ?? ??/Win ???? ?? ?
CyberCop ?? Win/Unix ???? ?? ?
ISS ?? Win ???? ???? ?
Nessus ??? Unix ?? ???? ?
13
DNS?????
14
DNS?????

• SANS????? TOP20????
• 1999-2002 CVE??????11?
• DNS???????

15
DNS???????
????DNS Security in Australia
16
??DNS????

• DNS????????(Spoofing)
• DNS????????(DoS)
• DNS??????
• Buffer Overflow
• DNS Worm

17
???DNS????
????TWCERT/CC(???????????????)2002.12
18
DNS????

• Buffer Overflow
• Crash Server
• Denial of Service
• Information Leak

19
DNS??????
20
???DNS????

• ??????(Lame Server)
• ????(Delegation Error)
• DNS????
• ????(Zone Transfer)
• ????

21
???????

• ????
• ???DNS????
• ????
• ????????????
• ????
• ????????
• Web????
• ???????????

22
????
23
???????(User Certificate Interface)

• ?TWNIC??
• ??TWNIC???????
• ?????????IP???????
• ????????????????

24
NSE(Nessus Scan Engine)

• ?????
• ??????????????
• Web????
• ??????????????

25
NASL(Nessus Attack Script Language)
NASL ????
26
Scan Result DateBase

• ?????????
• ??
• ????
• ????
• ??????
• ???????????????

27
????

• ??????
• ??????
• ??????
• ??????
• DNS??
• DNS????

28
DNS??????
29
DNS??????

• ???????
• ??????(Lame Server)
• ????(Delegation Error)
• DNS????
• ????(Zone Transfer)
• ????
• ????????
• ??????(?????????)
• ??????
• ?????????????

30
DNS??????

• ????
• Parent (???????DNS?????)
• NS(?????NS????)
• SOA(??NS????????????)
• MX(?????????)
• WWW(??????)
• ????
• ?????
• ??????

31
???????
32
??DNS??????
33
DNS?????????
34
(No Transcript)
35
(No Transcript)
36
(No Transcript)
37
(No Transcript)
38
DNS??????
39
DNS??????
40
??????
41
??????

• ???? 91.792.6
• ??????
• ?????1399 (???????)
• ?????1483 ?

42
DNS??????
DNS ?? ??(?) ???()
BIND 9?? 426 28.73
BIND 8?? 270 18.21
BIND 4?? 8 0.54
Windows DNS 677 45.65
??????? 102 6.88
????(TOTAL) 1483 100
43
DNS????
DNS ?? ??(?) ???()
DNS TRf ?? 1252 84.42
DNS XRf ?? 7 0.47
ZONE TRANS ?? 28 1.89
bind ?????? 31 2.09
BIND9_DoS 45 3.03
???? 118 7.96
????(TOTAL) 1483 100
44
DNS??????
DNS Domain Test
45
DNS?????? (cont.)
46
DNS?????? (cont.)
47
DNS?????? (cont.)
48
DNS?????? (cont.)
49
????

• DNS????
• DNS??????
• DNS??????

50
?????
51
??

• DNS???2001??bind 8.2.3???bind 9.X,????????????
• ??OS??????DNS???
• ???????DNS????????????
• DNS????????????DNS?????????,??????,??DNS???????
• ??????????????????

52
??

• ????????????????DNS??????????
• ???????????,??????????????????
• ??DNS??????,??????????????
• ??DNS???????DNS???????????????????????

53
??????

• DNS????????
• DNS?????????????
• IPV6 DNS???
• DNS ????

54
?????