僵尸网络

Eihal Alowaisheq

Siyuan Tang

Zhihao Wang

Fatemah Alharbi

Xiaojing Liao

XiaoFeng Wang

ACM CCS

The ACM Conference on Computer and Communications Security (CCS) is the flagship annual conference of the Special Interest Group on Security, Audit and Control (SIGSAC) of the Association for Computing Machinery (ACM). The conference brings together information security researchers, practitioners, developers, and users from all over the world to explore cutting-edge ideas and results. 

In recent years, the security implication of stale NS records, which point to a nameserver that no longer resolves the domain, has been unveiled. Prior research studied the stale DNS records that point to expired domains. The popularity of DNS hosting services brings in a new category of stale NS records, which reside in the domain's zone (instead of the TLD zone) for an active domain. To the best of our knowledge, the security risk of this kind of stale NS record has never been studied before. In our research, we show that this new type of stale NS record can be practically exploited, causing a stealthier hijack of domains associated with the DNS hosting service. We also performed a large-scale analysis on over 1M high-profile domains, 17 DNS hosting providers and 12 popular public resolver operators to confirm the prevalence of this security risk. Our research further discovers 628 hijackable domains (e.g., 6 government entities and 2 payment services), 14 affected DNS hosting providers (e.g., Amazon Route 53), and 10 vulnerable public resolver operators (e.g., CloudFlare). Furthermore, we conducted an in-depth measurement analysis on them, thus providing a better understanding of this new security risk. Also, we explore the mitigation techniques that can be adopted by different affected parties.

Zombie Awakening: Stealthy Hijacking of Active Domains through DNS Hosting Referral

近年来，DNS托管服务逐渐兴起，为用户带来便捷的同时也引发了新的安全风险。与此同时，过期NS记录（指向不再解析域名的域名服务器）问题也引起了广泛的讨论与研究。本文将二者结合，发现了由DNS托管服务停用导致的驻留在二级域的过期NS记录，证明了借此发起域名隐蔽劫持攻击的可行性和危害性，并提出了可供多方参考的解决方案。

【论文分享】僵尸唤醒：利用域名托管服务对活跃域名进行隐蔽劫持

Zombie Awakening: Stealthy Hijacking of Active Domains through DNS Hosting Referral查看来源