DNS Cache Poisoning Attack Reloaded:
Revolutions with Side Channels
Keyu Man, Zhiyun Qian, Zhongjie Wang,
Xiaofeng Zheng†, Youjun Huang†, Haixin Duan††Contents• Background• DNS Cache Poisoning• Part I: Infer Ephemeral Port
• Part II: Extend Attack Window• Our Attacks• Defenses• Conclusion• Disclosure2

DNS Cache Poisoning
6.6.6.6

2.2.2.2

CachedWrongrecord!

5.6.7.8
Trudy (Off-path)www.bank.com IP=6.6.6.6

www.bank.com IP=?

Alice’s Browser www.bank.com IP=6.6.6.6

www.bank.com IP=?
www.bank.com IP=2.2.2.2www.bank.com IP=?

ResolverTrudy

www.bank.com IP=6.6.6.6

5.6.7.8
bank.com Nameserver(NS)
3DNS Cache Poisoning

www.bank.com IP=6.6.6.6
5.6.7.8
Trudy (Off-path)

ResolverSrc: 5.6.7.8

IP Layer
UDP Layer

Dst: (resolver)
Src Port: 53

Dst Port: ? (16 bit)
TxID: ? (16 bit)

DNS Layer

Question: www.bank.com A ?
Answer: www.bank.com A 6.6.6.6, TTL=99999

Ephemeral Port=Client Port
Q:12345->53
ResolverR:53->12345

NSTraditional: 216 × 216 = 232 (Impossible in short time)
Our Side Channel: 216 + 216 ≈ 216
4

Contents• Background• Part I: Infer Ephemeral Port
• Method I: Direct Scan (Refer to the Paper)• Method II: Side-channel-based Scan

• Part II: Extend Attack Window• Our Attacks• Defenses• Conclusion• Disclosure
5

Port Inference: Basics
ResolverAttacker

APP

OS

Listen on 53
UDP dport=53

UDP dport=67

Packet

ICMP: 67 isn’t open

6

Port Inference: Ephemeral Ports
ResolverAttackerNameserver
DNS Query(Ephemeral Port) 1234->53
UDP dport=1234

UDP dport=1234

ICMP: 1234 isn’t open

7

Port Inference: IP Spoofing

5.6.7.8
Attacker5.6.7.8
Nameserver

ResolverUDP dport=1234

UDP dport=5678

ICMP: 5678 isn’t open

8Port Inference: Side Channel• ICMP Global Rate Limit: 50 ICMPs / 50 ms• Limit sending rate
• Shared by all IPs

Off-Path TCP Exploits: Global Rate Limit Considered Dangerous
USENIX Security 2016

9Port Inference: How It Works
ResolverNameserverwith NO port open
Counter=50

Hit 50 closed ports

Attacker

ResolverNameserverwith ONE port open

AttackerCounter=50
50 UDP Probes

Hit 49 closed ports&1 open port

50 ICMPs

50 UDP Probes

49 ICMPs
Counter=50-49=1

Counter=50-50=0

Verification

Verification

Spoofed

ICMP Reply
Normal10

Port Inference: Measurement• Open Resolvers:• 34% Vulnerable• Well-known Public Resolvers:• 12/14 Vulnerable
GoogleCloudflare
OpenDNS
ComodoDyn
Quad9
AdGuard
CleanBrowsing
NeustarYandex
Baidu DNS
114 DNS
Tencent DNS
Ali DNS

8.8.8.8
1.1.1.1
208.67.222.222
8.26.56.26
216.146.35.35
9.9.9.9
176.103.130.130
185.228.168.168
156.154.70.1
77.88.8.1
180.76.76.76
114.114.114.114
119.29.29.29
223.5.5.5
11

Contents• Background• Overview• Part I: Infer Ephemeral Port
• Part II: Extend Attack Window• Strategy I: Malicious Name Server (Refer to the Paper)• Strategy II: Response Rate Limiting• Our Attacks• Defenses• Conclusion• Disclosure
12Extend Attack Window
ClientResolver

RRL: 18%
Deployed

AttackerNameserver

QueryQueryAttack
Window
AttackWindow

Fake
Response

Flooding
Response Queries
Response
13

Contents• Background• Part I: Infer Ephemeral Port
• Part II: Extend Attack Window• Our Attacks• Forwarder Attack (Refer to the Paper)• Resolver Attack• Defenses• Conclusion• Disclosure
14

Production Resolver Attack

Unbound Worker

Unbound Worker

Pacific Ocean
70M queries/day

AttackerOpen Resolver

20ms delay, 3ms jitter, 0.2% loss

2 Name Servers(Ethical Concerns: Controlled by us)

15

Resolver Attack: Results

Setup

ResultAttack# Back Server# NSJitter

Delay

Loss

Total Time

Success Rate

Tsinghua

2

23ms

20ms

0.2%

15 mins

5/5Commercial

4

12ms

30ms

0.6%

2.45 mins

1/1

Refer to the paper for more exciting results!

16

Contents• Background• Part I: Infer Ephemeral Port• Part II: Extend Attack Window• Our Attacks• Defenses• Conclusion• Disclosure17Defenses• DNSSEC• 0x20 encoding• DNS cookie• Only 5% open resolvers deployed• Disable ICMP port unreachable• Randomize ICMP global rate limit

18

Contents• Background• Part I: Infer Ephemeral Port
• Part II: Extend Attack Window• Our Attacks• Defenses• Conclusion• Disclosure

19Conclusion• Side-channel-based UDP port scan.
• Make DNS cache poisoning possible again!
• Real-world attacks.

20

Contents• Background• Part I: Infer Ephemeral Port
• Part II: Extend Attack Window• Our Attacks• Defenses• Conclusion• Disclosure

21Disclosure22

Thank you!
Q&A
Source code & more interesting projects
https://github.com/seclab-ucr/

Keyu Man
kman001@ucr.edu