DNS转发设备面临缓存中毒攻击威胁：安全漏洞与解决方案

论文

USENIX

需积分: 17 79 浏览量更新于2024-07-15 收藏 4.5MB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源详情

资源推荐

Figure 2: CDF of lowered MTU of a) authoritative servers

of Alexa Top 100K domains, and b) 2M open DNS resolvers

from an Internet-wide scan.

proaches proposed so far. The ﬁrst approach is to lower the

Path Maximum Transmission Unit (PMTU) between the re-

cursive resolver and authoritative servers [33]. We term this

type of attack as PMTU-based defragmentation attack. By

contrast, the second approach is to send DNSSEC queries to

solicit enlarged DNS responses with DNSSEC records, so

that they reach limits of MTUs (e.g., 1,500 bytes for Ether-

net) and will be fragmented [48]. We term this type of attack

as DNSSEC-based defragmentation attack.

Limitations. Previous defragmentations have high require-

ments on the PMTU behavior of authoritative name servers,

as well as the victim domains. Speciﬁcally, PMTU-based de-

fragmentation requires an attacker to send specially-crafted

ICMP fragmentation needed error messages to an authorita-

tive server claiming a small PMTU and trick it to lower the

PMTU for a speciﬁc resolver. However, we ﬁnd this is im-

practical in most cases. As shown in Figure 2, for authorita-

tive servers of Alexa Top 100K domains, only 0.7% are will-

ing to reduce their MTU to less than 528 bytes. Since DNS

responses are typically smaller than 512 bytes, it is not likely

that they will be forcibly fragmented. As for DNSSEC-based

attacks, they require non-validating recursive resolvers and

can be mitigated through proper DNSSEC deployment and

validation. Moreover, the attack only works for DNSSEC-

signed victim domains. Currently, DNSSEC deployment is

still low among domain names (e.g., less than 1.85% for

popular domains in 2017 [34]), thus the target of DNSSEC-

based defragmentation attacks is limited.

3 DNS Forwarder

Traditionally, a DNS resolution process involves a DNS

client (or stub resolver), a recursive resolver and authori-

tative servers. When a domain needs to be resolved, the

DNS client sends a query to a recursive resolver, which in

turn fetches answers from authoritative servers. For maxi-

mum protocol capability, it is recommended that DNS clients

use a full-service resolver directly [31]. However, in reality,

the DNS infrastructure has become far more complex than

Figure 3: DNS infrastructure with forwarders

this simple model, often involving multiple layers of servers.

One of the new roles introduced in the infrastructure [29,70],

as shown in Figure 3, is DNS forwarders

. They sit in be-

tween stub and recursive resolvers, and often serve as ingress

servers for DNS clients (e.g., home wireless routers). When

a DNS forwarder receives a query, instead of performing the

resolution recursively, it simply forwards the query to an up-

stream recursive resolver. To name a few use cases, it can

serve as a default local resolver (with caching capability) for

clients (e.g., clients using DHCP to obtain network conﬁg-

urations in LAN), perform load balancing among upstream

recursive resolvers, and can be used to enforce access con-

trol.

DNS forwarder vs. recursive resolver. In the latest RFC

on DNS terminology (i.e., RFC 8499 [50]), recursive re-

solvers are resolvers which “act in recursive mode”. When

it receives a DNS query, a recursive resolver accesses other

servers, and should respond with the ﬁnal answer to the

original query. As such, recursive resolvers should handle

referrals to other servers and aliases to other names (i.e.,

CNAMEs), and aggregate the resource records into one ﬁnal

answer. Recursive resolvers should also perform integrity

checks such as the bailiwick check [39] and DNSSEC val-

idation [30]. In contrast, a DNS forwarder does not recur-

sively resolve queries, and instead relies on the integrity of

its upstream server. As a result, DNS forwarders do not han-

dle referrals, and are typically not in the position to verify

the responses. Otherwise, forwarders will be repeating the

work of resolvers, e.g., checking each referral, defeating the

purpose of having another layer of indirection. As we will

articulate later, this is a key weakness of DNS forwarders

which enables our cache poisoning attack.

4 Defragmentation Attacks

Targeting DNS Forwarders

As we have seen, previous defragmentation attacks have lim-

itations regarding the ability to trigger fragmentation. In this

section, we propose a novel modiﬁed defragmentation at-

tack that works perfectly against DNS forwarders due to its

unique role in the DNS infrastructure.

Also deﬁned as “FDNS” in literature.

USENIX Association 29th USENIX Security Symposium 579

剩余17页未读，继续阅读

「已注销」

粉丝: 23
资源: 1

DNS转发设备面临缓存中毒攻击威胁：安全漏洞与解决方案

Towards Data Poisoning Attack against Knowledge Graph Embedding.pdf

DNS缓存投毒攻击原理与防御策略.pdf

tcpip实验指导书

帮我找一找关于数据投毒攻击的英文文献

Key Retrieval is not allowed

poisoning and backdooring contrastive learning.

poison frogs! targeted clean-label poisoning attacks on neural networks复现

TCP Misuse

kali为攻击机，ip地址为172.20.10.10 win10为靶机，ip地址为172.20.10.9 现在kali要使用ettercap的命令行实现arp欺骗，使靶机在访问www.nlc.cn时被劫持，直接跳转到172.20.10.10 请给出具体的操作步骤和命令行

药物中毒急救python

还有没有更完善一点的

python实现明星专家系统

kali arp欺骗截获工具

snort编写规则检测ARP攻击

ettercap0.8.3.1使用教程

在ubuntu上搭建的简单网络拓扑图，如何利用ettercap工具实现中间人欺骗

kali linux arp欺骗

arp欺骗和arp攻击

RIP协议如何解决路由环路

最新资源