Thirty Years of DNS Insecurity: Current Issues and Perspectives

Abstract

When DNS was created, nobody expected that it would have become the base for the digital economy and a prime target for cybercriminals. And nobody expected that one main asset of the digital economy would have been users’ browsing habits, putting at risk their privacy. The DNS was designed and implemented according to speed, scalability, and reliability criteria, whereas security and privacy did not fit in the objectives. Although the first attacks were already conceived about thirty years ago, the DNS infrastructure - with a bunch of improvements but its original design - continues to play a pivotal role in enabling access to services, data and devices. And, despite the fairly widespread adoption of DNSSEC security extensions in recent years, DNS attacks are becoming more and more frequent, sophisticated and dangerous. They are global, varied, dynamic and can circumvent traditional security systems such as next-generation firewalls and data loss prevention systems. A revisitation of DNS assumptions has been proposed in very different ways, reflecting diverse point of views in terms of Internet governance and user freedom, and a great effort is in place by standardization bodies, industry consortia and academic research to converge toward an updated design and implementation. The present work overviews the most promising proposals, trying to shed some insight on the future of DNS.