In my DNS server query logs, I am starting to see more queries usingmixed case, like for example:
jOHanNEs.HoMePC.OrG
www.HOMEPC.ORg
wWW.Homepc.org
Www.HoMepC.ORg
WwW.homepc.ORg
WwW.HOmepc.oRG
WWw.homePc.oRg
These queries appear to be the result of DNS servers supporting a relativelynew DNS security mechanism, 0x20 Bit encoding. The approach got its namefrom encoding a bit value using the case of letters. if bit 0x20 is set in abyte, the letter is lower case. If it is cleared, the letter is upper case.
For example, the first value show above ( www.HOMEPC.ORg ) represents a valueof 11100000001 . How does this help DNS security? Host names are not casesensitive. However, the case is maintained. The answer will use the samemixed case as the query. For example:
DiG 9.7.3-P3 -HEADER ANSWER SECTION:
WwW.HoMePc.OrG. 100 IN A 70.91.145.9
.. [rest of answer omited] ...
As it turns out, almost all DNS servers follow this behaviour. The new part is thatnow some DNS servers start to deliveratly encode a random value into each query theysend, and then verify if the value is maintained in the response. This in effect addsadditional bits to the query id.
While this is clearly a hack, it is a pretty attractive one. If your DNS serversupports this feature, it will automatically gain a few more bits of spoofingresistance. The DNS servers it connects to do not need to change anything. Unlikefor DNSSEC, which is of course the real fix, but requires extensive work to configure,and has to be configured for each zone.
Right now, none of the major DNS servers appear to support this feature. A Google searchonly found two pieces of software that do:
Unbound: https://calomel.org/unbound_dns.html: see use-caps-for-id
pydig: http://www.huque.com/software/pydig/
I would be interested to learn if there are other DNS servers (or DNS related software)that supports this method.
References:
http://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
http://courses.isi.jhu.edu/netsec/papers/increased_dns_resistance.pdf
------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.