Re: [secdir] Security review of draft-ietf-dnsop-onion-tld-00.txt

["Christian Huitema" <[e-mail]>]

On Monday, August 31, 2015 12:58 AM, Mark Nottingham wrote:
 
> * <https://github.com/mnot/I-
> D/commit/358186a82887ed3907537bc45bd37937b4a6a09e> moves much of
> the generic explanatory text from Security Considerations into the
> Introduction, as per the SecDir review.

Good edit, thanks.
 
> * <https://github.com/mnot/I-
> D/commit/ca1eaaec5129f7ce82df8a749c11eb692de1059c> notes what
> happens when legacy systems get DNS queries leaked to them, as per the
> SecDir review.

The summary being, "if a legacy client mistakenly sends a DNS query for a
.onion name to a DNS resolver, the TOR security checks will prevent server
impersonation, but the client will have disclosed the intent to use the TOR
network to reach a specific service." The way I understand it, there are
parts of the world where disclosing such activity is plus plus not good,
correct? A mitigation for such leaks would be having the client's DNS
software act as a backstop and drop any request to a .onion name, without
relaying them.

> * I didn't yet do anything to address this feedback in the SecDir review:
> 
> > Then, the security section also does not discuss how malicious name
> resolvers could be deployed in order to attack the TOR network. For
example,
> if TOR security relies on DNS servers “black holing” misrouted request to
> resolve “.onion” names, what happens if malicious servers replace the
> suggested black-holing with some malicious tampering?
> 
> Christian, how would that work? I don't see how this kind of attack (by
having
> a malicious server leverage clients who erroneously forward DNS requests
for
> .onion) is going to be qualitatively different from any other attack on
the Tor
> network; indeed, it doesn't seem like a very effective way to attack the
> network itself. Now, it may be that you can trick some users into thinking
> they're on Tor when they're not, in the right circumstances, but that's
not an
> attack on the network.

How about:

A legacy client may inadvertently attempt to resolve a ".onion" name through
the DNS. This causes a disclosure that the client is using TOR to reach a
specific service. Malicious resolvers could be engineered to capture and
record such leaks, which might have very adverse consequences for the
well-being of the TOR user. This issue is mitigated if the client's TOR
software is updated to not leak such queries, or if the client's DNS
software is updated to drop any request to the ".onion" TLD.

-- Christian Huitema