Going Wild: Large-Scale Classification of Open DNS Resolvers

摘要: Since several years, millions of recursive DNS resolvers are-deliberately or not-open to the public. This, however, is counter-intuitive, since operation such openly accessible necessary in rare cases only. Furthermore, open enable both amplification DDoS and cache snooping attacks, can be abused by attackers multiple other ways. We thus find remain one critical phenomenon on Internet.In this paper, we illuminate analyzing it from two different angles. On hand, study landscape based empirical data collected for over a year. analyze changes time classify according device type software version. take viewpoint client measure response authenticity these resolvers. Besides legitimate redirections (e.g., captive portals router login pages), deliberately manipulate resolutions (i.e., return bogus IP address information). To understand threat more detail, systematically non-legitimate responses reveal that censor communication channels, inject advertisements, serve malicious files, perform phishing, redirect kinds suspicious activities.