Home / News

DNS Survey Results Pandora's Box of Both Frightening and Hopeful Results, Says Cricket Liu

The fifth-annual survey of domain name servers (DNS) on the public Internet — called a "Pandora's box of both frightening and hopeful results" — was released today by The Measurement Factory in partnership with Infoblox. Cricket Liu, Vice President of Architecture at Infoblox and author of O'Reilly & Associates' DNS and BIND, DNS & BIND Cookbook says: "Of particular interest is the enormous growth in the number of Internet-connected name servers, largely attributable to the introduction by carriers of customer premises equipment (CPE) with embedded DNS functionality. This equipment represents a significant risk to the rest of the Internet, as without proper access controls, it facilitates enormous DDoS attacks."

Following are the key 2009 DNS survey results from the survey — along with positive, negative, or neutral "consequence" ratings — based on a sample that included 5 percent of the IPv4 address space, nearly 80 million addresses.

  • NEUTRAL: There are an estimated 16.3 million name servers on the Internet; this represents a 40% increase in 2 years likely due to an explosion in the population of "non-traditional", proxy DNS servers embedded in broadband access devices or customer premises equipment (CPE).
  • VERY DISTURBING: 79.6% of the name servers are open to recursion; this represents a 27% increase in the last 2 years, likely related to the increase in proxy DNS servers in CPE. Unfortunately, all these name servers can be used maliciously to execute DDOS attacks, posing a significant threat to the Internet.
  • POSITIVE: Percentage of Microsoft DNS Servers is now almost negligible at .37%; this is likely due to greater awareness of the risks of exposing Windows computers to the Internet.
  • POSITIVE: Percentage of zones with one or more name servers open to zone transfers decreased to 16% from 31% (in 2008); administrators are paying closer attention to configuration of external DNS servers, realizing that they need to configure ACLs to prevent zone transfers, which can leave them open to DOS attacks.
  • POSITIVE: The number of DNSSEC signed zones increased significantly — by approximately 300%; this indicates that momentum in DNSSEC adoption is increasing. This could be the result of greater awareness and adoption due to the Kaminsky vulnerability last year and support for DNSSEC signed in parent zones (.org).

Related Links: Executive Summary, Press Release

Related topics: DDoS, DNS, DNS Security, Security

 
   
WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

To post comments, please login or create an account.

Related Blogs

Related News

Explore Topics

Industry Updates – Sponsored Posts

Encrypting Inbound and Outbound Email Connections with PowerMTA

Resilient Cybersecurity: Dealing with On-Premise, Cloud-Based and Hybrid Security Complexities

What Holds Firms Back from Choosing Cloud-Based External DNS?

Verisign Releases Q4 2015 DDoS Trends - DDoS Attack Activity Increasing by 85% Year Over Year

Best Practices from Verizon - Proactively Mitigating Emerging Fraudulent Activities

Neustar Data Identifies Most Popular Times of Year for DDoS Attacks in 2015

The Framework for Resilient Cybersecurity (Webinar)

Data Volumes and Network Stress to Be Top IoT Concerns

DKIM for ESPs: The Struggle of Living Up to the Ideal

Computerworld Names Afilias' Ram Mohan a Premier 100 Technology Leader

Verisign Mitigates More Attack Activity in Q3 2015 Than Any Other Quarter During Last Two Years

Protect Your Privacy - Opt Out of Public DNS Data Collection

Verisign & Forrester Webinar: Defending Against Cyber Threats in Complex Hybrid-Cloud Environments

Measuring DNS Performance for the User Experience

Introducing Verisign Public DNS: A Free Recursive DNS Service That Respects Your Privacy

Faster DDoS Mitigation - Introducing Verisign OpenHybrid Customer Activated Mitigation

Internet Grows to 296 Million Domain Names in Q2 2015

Verisign's Q2'15 DDoS Trends: DDoS for Bitcoin Increasingly Targets Financial Industry

Protect Your Network From BYOD Malware Threats With The Verisign DNS Firewall

Announcing Verisign IntelGraph: Unprecedented Context for Cybersecurity Intelligence

Sponsored Topics

Verisign

Security

Sponsored by
Verisign
Port25

Email

Sponsored by
Port25
Afilias

DNS Security

Sponsored by
Afilias
Afilias - Mobile & Web Services

Mobile

Sponsored by
Afilias - Mobile & Web Services