夏鹏城

王浩宇

周瑜

刘新宇

霞浦罗

许国爱

加雷斯·泰森

ACM ASIACCS

Building on the success of ACM Conference on Computer and Communications Security (CCS), the ACM Special Interest Group on Security, Audit, and Control (SIGSAC) formally established the annual ACM Asia Conference on Computer and Communications Security (ASIACCS). The inaugural ASIACCS was held in Taipei (2006). Since then ASIACCS has been held in Singapore (2007), Tokyo (2008), Sydney (2009), Beijing (2010), Hong Kong (2011), Seoul (2012), Hangzhou (2013), Kyoto (2014), Singapore (2015), Xi’an (2016), Abu Dhabi (2017), Songdo (2018), Auckland (2019), Taipei (2020, virtual), Hong Kong (2021, virtual) and Nagasaki (2022, hybrid).

DNS has often been criticized for inherent design flaws, which make the system vulnerable to attack. Further, domain names are not fully controlled by users, meaning that they can easily be taken down by authorities and registrars. Due to this, there have been efforts to build a decentralized name service that gives greater control to domain owners. The Ethereum Name Service (ENS) is a major example. Yet, no existing work has systematically studied this emerging system, particularly regarding security and misbehavior. To address this gap, we present the first large-scale measurement study of ENS. Our findings suggest that ENS has shown growth during its four years' evolution. We identify several security issues, including traditional name system problems, as well as new issues introduced by the unique properties of ENS. We find that attackers are abusing the system with thousands of squatting ENS names, a number of scam blockchain addresses and indexing of malicious websites. We further develop a new record persistence attack, to find that 22,716 .eth names (3.7% of all names) are vulnerable to name hijacking. Our exploration suggests that our community should invest more effort into the detection and mitigation of issues in decentralized name services.

Challenges in decentralized name management: the case of ENS

本次分享的论文是一项关于去中心化域名系统的大规模测量研究，即以太坊域名服务（Ethereum Name Service，ENS）。文章第一作者来自于北京邮电大学。论文围绕以太坊域名服务，对其部署应用的生态以及潜在安全风险进行了系统性的分析。论文录用于国际网络测量顶级会议ACM Internet Measurement (IMC) 2022。

【论文分享】关于去中心化域名系统 ENS 的测量分析（互联网域名系统安全学术前沿系列）

Challenges in decentralized name management: the case of ENS查看来源