DNS Cache Poisoning Attack:Resurrections with Side Channels
Keyu Man Xin'an Zhou Zhiyun Qian

Contents• Background• DNS Cache Poisoning• Threat Model• Attack Overview• ICMP-Based Port Scan
• Evaluation• Defenses• Conclusion• Disclosure
2

DNS Cache Poisoning
6.6.6.6

2.2.2.2

CachedWrongrecord!

SADDNS

5.6.7.8
Trudy (Off-path)www.bank.com IP=6.6.6.6

www.bank.com IP=?

Alice’s Browser www.bank.com IP=6.6.6.6

www.bank.com IP=?
www.bank.com IP=2.2.2.2

www.bank.com IP=?

ResolverTrudy

www.bank.com IP=6.6.6.6

5.6.7.8
bank.com Nameserver(NS)3Threat Model• Off-path attacker• Attacker can trigger request• Wi-Fi router• Coffee shop
• AirportForwarders• 8.8.8.8• 9.9.9.9• Campus/ISP DNS server

Resolvers

Off-path Trudy

IP Src=5.6.7.8

Legitimate Trudy
IP Src=t.r.d.y8.8.8.8
Resolver5.6.7.8
Nameserver

4

Attack Overview

Start

Identify Victim Resolver and NS
Task 1

Task 2

Slowdown NS

Trigger Request

ICMP-based Port Scan
Found Open Port

Not Poisoned

Brute Force TxID

Check Cache
Poisoned
End5Contents• Background• ICMP-Based Port Scan
• ICMP Processing Logic• Public-facing Port Scan
• Private-facing Port Scan
• Colliding IP Inference• Evaluation• Defenses• Conclusion• Disclosure
6ICMP Processing Logic• Why ICMP has to do with DNS attack?
• It can piggyback port info!

7

ICMP Processing Logic
How is the port info used?

5.5.5.5->10.0.0.1
ICMP Frag Needed: max MTU=800
Original packet:
10.0.0.1:34567->5.6.7.8:53
10.0.0.1:34568->5.6.7.8:53
DNS Request

Receive ICMP err

No MatchFound MatchDropUpdate
Update Routing
Routing Table
Table(Shared Resource!)… …

Check Wrapped 4-tuple
Against Active Sockets

Socket table:10.0.0.1:34567->5.6.7.8:53 CONNECTEDSide Channel!

Notify App Layer
DNS Request

BIND

8

ICMP Processing Logic
ICMP Fragment Needed & ICMP Redirect• The only ICMP errs modifying the shared resources• i.e., update routing table• Frag needed• Packet exceeds MTU• PMTU for a host is updated in routing table• Redirect (more details in the paper)• Better routes available• Next hop to a host is updated in routing table9

Public-facing Port Scan
• listen()ing ephemeral ports• No check on IP during socket matching• Only port # !
• Alter PMTU of any IP!

• “public-facing”• dnsmasq• Idea• Try lowering attacker’s own PMTU
• Check fragments

10

Public-facing Port Scan
Victim r
port n open

Frag Needed Probe

Frag Needed Probe
D=r

S=r, D=a

M=1200SP=nPMTU of a
1200
Verify Ping
D=r

Victim r
port n closed

Off-path
Attacker aPING

D=r

M=1200

Verify Ping
D=r

Verify Reply Frag1
D=a, MF=1Legend:

PING

1152 bytes

SP=n

PMTU of a1500 (unchanged)

InternalState
Change1300 bytes

S=r, D=a

PING

1300 bytes

Verify Reply
D=a

PING

1300 bytes

Verify Reply Frag2

DataIP Header

D=a, MF=0 148 bytes

UDP Header
ICMP Header

Keys: D=Destination IP, S=Source IP, M=PMTU, SP=Source Port, MF=More Fragment

11

Private-facing Port Scan
• connect()ed ephemeral ports• Complete 4-tuple is checked• Only NS’ PMTU can be modified• Unknown to the attacker directly• “private-facing”• BIND, Unbound, …

• How to observe the change of NS’ PMTU?
• Next Hop Exception (fnhe) Cache

12fnhe Cache

Private-facing
PortScan01Buckets
fnhe Cache• ICMP caused route changes• i.e., PMTU & next hop• Unexpected• “next hop exceptions” (fnhe)• fnhe• Cached

...

756

…

2046

Slots

2001::1
3001::1H(3001::1,key)=756
H(2001::1,key)=756

2002::2H(2002::2,key)=756

2003::3H(2003::3,key)=756

2004::4H(2004::4,key)=756

2005::5H(2005::5,key)=756

2047

2001::1 and 3001::1 are colliding IPs• 2048-bucket hash table• 5 slots per bucket to solve collision• Random seed as hash key• H(): IP addr->bucket• Garbage collected• Overwrite the oldest slot when bucket is full13

Infer ICMP Port Scan Results

Next slide:
How to choose c1-c5

Private-facing Port Scan
Victim r
Infer ICMP Port Scan
portResults
n openVictim r
port n closed

Off-path
Attacker c1

5 Plant Packets

5 Plant Packets

Buckets ...

𝑛Slots

auc1

D=r

…

S=r, D=cn

PONG

D=r

Frag Needed Probec2Internal
StateChange

M=1200

D=rc3

M=1200S=r, D=au SP=n, DP=53

M=1200S=r, D=cn

PONG

Frag Needed Probe
D=r

S=r, D=au SP=n, DP=53

M=1200

Buckets ...

𝑛Slots

c1…

c2
c3

c4

Verify Ping

Verify Ping

c5
D=r

PING

1300 bytes

D=r

PING

PMTU of c1: 1500 (default)
Verify Reply

1300 bytes

c4
c5

PMTU of c1:1200
Verify Reply Frag0

Legend:Data

D=c1 PING

1300 bytes

D=c1, MF=1

PING

1152 bytes

IP Header

UDP Header

Verify Reply Frag1

ICMP Header

D=c1, MF=0148 bytes

14Keys: D=Dst IP, S=Src IP, M=PMTU, SP=Src Port, DP=Dst Port, MF=More Fragment, cn(c1-c5)=Colliding IPs, au=Authoritative Name Server, PONG=Ping Reply

Colliding IP Inference• How to choose c1-c5?

5 Plant Packets
D=r

M=1200S=r, D=cn

PONG

fnhe Cache:c1->c2->c3->c4->c5• Collide with NS’ IP (au)• Collide with each other• Attacker controls c1• Idea: Hash key inference->calculate c1-c515

Key Inference

Colliding IP Inference
0Buckets
Key Inference

1...

1. Control 1500 IPs• Easy for IPv6 (/64)• AWS if IPv4 (1500 nano instances)• 1500*$0.0042/hr

756

…

2046

2047

2001::1
2001::6

Frag

2001::112001::66

Frag

2001::2

Frag

2001::22

Frag

2001::3

Frag

2001::33

Frag

2001::4

Frag

2001::44

Frag

2001::5

Frag

2001::55

Frag

2. Send 1500 ICMP frag neededs• Some entries will be replaced

3. Send 1500 PINGs

Evited: 2001::1 2001::11
Non-frag Non-frag• Log IPs (evicted IPs) replying no frags

4. Brute-force key by simulating 2&3 locally• Key=0, key=1,…, key=0xffffffff• Check if the evicted IPs match• Only 2-min guess after distributing to 1500 nano instances

16

Contents• Background• ICMP-Based Port Scan
• Evaluation• Comparison with SADDNS• End-to-end Attacks• Vulnerable Population• Defenses• Conclusion• Disclosure
17Comparison with SADDNS+ Novel port inference method• ICMP vs. UDP+ New dimension of the shared resource• Spatial vs. temporal• fnhe cache hash table vs. ICMP rate limit counter+ Fast port scan speed• Unlimited vs. 1000 pps+ Resistant to noise• No time sync vs. 50-ms time sync

- Preparation of the attack• Inferring colliding IPs (hash key)18

End-to-end Attacks
Bind9 Resolver Attack Setup

40ms delay, 3ms jitter, 0.2% loss

Home Gateway

Pacific OceanAttacker

70M queries/day(Simulated)
BIND 9.16.13
Resolver

Wired link

2 Name Servers(Ethical Concerns: Controlled by us)

19End-to-end Attacks
Attack Results• Average success time: 80-900s• Time varies due to slightly different setup (more details in the paper)• Other attacks:• Forwarder attack: 13s• Real public resolver attack: 105s avg.

20

Attack Results

keyu@ubuntu:~$ dig @a.xiaofengtest.net; <<>> DiG 9.10.3-P4-Ubuntu <<>> @a.xiaofengtest.net; (1 server found);; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 59301;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0,ADDITIONAL: 1

keyu@ubuntu:~$ dig @a.xiaofengtest.net; <<>> DiG 9.10.3-P4-Ubuntu <<>> @a.xiaofengtest.net; (1 server found);; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57535;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0,ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 1232;; QUESTION SECTION:;a.xiaofengtest.net.
IN

A;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 1232;; QUESTION SECTION:;a.xiaofengtest.net.
INAA;; ANSWER SECTION:
a.xiaofengtest.net.

A;; ANSWER SECTION:
a.xiaofengtest.net.

28

IN;; Query time: 190 msec;; SERVER:#53();; WHEN: Fri Sep 24 17:11:34 EDT 2021;; MSG SIZE rcvd: 63

6.6.6.6500

IN

1.2.3.4;; Query time: 448 msec;; SERVER:#53();; WHEN: Fri Sep 24 17:11:36 EDT 2021;; MSG SIZE rcvd: 63

21

Vulnerable Population
Open-source Software• Vulnerability in both OS and DNS software• Varies among diff. kernel and software combinations.

• OS• Linux: 3.6-5.14• DNS• BIND: 9.3-9.16• Unbound: <1.13• dnsmasq: any (at the time of testing)22

Vulnerable Population
Open Resolvers• Open resolvers• 14% of backend IPs• 38% of frontend IPs• Public resolvers• 6 out of 1223

Contents• Background• ICMP-Based Port Scan
• Evaluation• Defenses• Conclusion• Disclosure

24Defenses• Defeat off-path attacks• 0x20 eNcoDinG• DNS cookie• DNSSEC• Mitigate the side channel• Set IP_PMTUDISC_OMIT socket option• Randomize fnhe caching• Eviction policy, bucket depth…

25

Contents• Background• ICMP-Based Port Scan
• Evaluation• Defenses• Conclusion• Disclosure

26

Conclusion• A novel side channel from next hop exception cache• ICMP-based port scan
• Poison the cache of DNS in minutes• Update Linux kernel to mitigate the attack

27

Contents• Background• ICMP-Based Port Scan
• Evaluation• Defenses• Conclusion• Disclosure28

Disclosure29Thank you!

Source code & more interesting projects
https://github.com/seclab-ucr/

Keyu Man
kman001@ucr.edu