(Well-known)"Redirect the target domain'snameserver“
cache poisoning attacks
Kazunori Fujiwara, JPRS
fujiwara@jprs.co.jp
IEPG meeting, Toronto
2014/7/20

(Well-known) references• Bernhard Müller, “Improved DNS spoofing using node
re-delegation”, August 2008
• Wikipedia DNS spoofing– http://en.wikipedia.org/wiki/DNS_spoofing
Redirect the target domain's nameserver
The first variant of DNS cache poisoning involves redirecting
the nameserver of the attacker’s domain to the nameserver of
the target domain, then assigning that nameserver an IPaddress specified by the attacker.

• Dan Kaminsky, “DNS 2008 and the new (old) nature ofcritical infrastructure”, July 2008
• RFC 3833 Threat Analysis of the Domain Name
System (DNS)– 2.2. ID guessing and query prediction
Copyright © 2014 Japan Registry Services Co., Ltd.

2

Basic attack image
Send ① trigger query.
Before arriving ③⑤⑦,
send forged responses whichlook like genuine response ③⑤⑦
23
Full-Resolver
45(Cache)
Trigger queryas end user’squery

TLD (TopLevel Domain)

JP6718RootRootForgedResponses

NET COM

example.jpjprs.co.jp

Organization

Attacker

Authoritative DNS Servers
Copyright © 2014 Japan Registry Services Co., Ltd.

3

Detailed attack image (www.google.com)
ns[1234].google.com
Full resolver port P
ns1.google.com port 53
ID mmm, Query(random).www.google.com A

Trigger querySrc addr/portgoogle.com
Dest addr/port
6
DNS header
7
ns1.google.com port 53
QuestionFull resolver port P
Authority

Full resolver(Cache)8

Attacker port any
Full resolver port 53
ID any, Query(random).www.google.com A

www.google.com
is not cached
www.google.com NS
may be accepted1my-server
www.google.com zone
www.google.com A

ID mmm, Response, rcode 3(random).www.google.com A
google.com SOAAttacker

Before ⑦, send forged responses
ns1.google.com port 53
Full resolver port P
ID mmm, Response, rcode 0(random).www.google.com A
www.google.com NS my-server
Forged responses(same IP addr, port, ID, Question section
different RCODE, different Authority)

Copyright © 2014 Japan Registry Services Co., Ltd.

4

Attack details• Choose a trigger domain name ($Trigger)• Send a trigger query “(random).$Trigger A”– Authoritative server returns name error (rcode 3) for thequery name
– The trigger domain name is not cached by the full resolver• Send forged responses– IP src = authoritative server addresses of Trigger domain– IP dst = full resolver’s address– src port = 53
– dst port = full resolvers port (static, or random number)– DNS header: Rcode 0, response, ID = random number– Question section = “(random).$Trigger A”– Authority = what you want to inject : “Target NS my-server”• Prepare Target zone in my-server– *.Target IN A 192.2.0.2
Copyright © 2014 Japan Registry Services Co., Ltd.

5

Target domain names
1. Domain names which does not have NS– Host names (www.google.com, www.iepg.org, ...)
– Some non-terminals (co.jp, tokyo.jp, …)

2. Some zone cuts
– When an authoritative server serves both a zone
and its descendant zones– The shallowest zone apex is not a target– If a deepest name is a zone cut, it is not a target– Example 1: “net” and “root-servers.net”•Root servers serve both “.” and “root-servers.net”– Example 2: “co.uk”•uk servers serve both “uk” and “co.uk”
Copyright © 2014 Japan Registry Services Co., Ltd.

6

Attack example:co.jp[a-g].dns.jp
Full resolver port Pa.dns.jp port 53
ID mmm, Query(random).co.jp A

Trigger querySrc addr/port
Dest addr/port
DNS header ４
５Question
Authority

Full resolver(Cache)8

Attacker port any
Full resolver port 53
ID any, Query(random).co.jp Aco.jp NS
is not cacheda.dns.jp port 53
Full resolver port PID mmm, Response, rcode 3(random).co.jp Ajp SOA

co.jp NS
may be accepted

1my-serverco.jp zone*.co.jp A 192.2.0.2

jpAttacker

Before ⑤, send forged responses
a.dns.jp port 53
Full resolver port P
ID mmm, Response, rcode 0(random).co.jp Aco.jp NS my-server
Forged responses(same IP addr, port, ID, Question section
different RCODE, different Authority)

Copyright © 2014 Japan Registry Services Co., Ltd.

7

Attack example:net
Only when “net NS” is not cached by victim full resolvers
Full resolver port P
a.root-servers.net port 53
ID mmm, Query(random).root-servers.net A

Trigger query[a-m].root-servers.net

Src addr/port
Dest addr/port“.” and root-servers.net
2
DNS header
3
a.root-servers.net port 53
QuestionFull resolver port P
Authority

Full resolver(Cache)8Attacker port any
Full resolver port 53
ID any, Query(random).root-servers.net Anet NS
is not cached
net NS
may be accepted1
my-server
net zone*.net A 192.2.0.2

ID mmm, Response, rcode 3(random).root-servers.net A
root-servers.net SOA

Attacker

Before ③, send forged responses
a.root-servers.net port 53
Full resolver port P
ID mmm, Response, rcode 0(random).root-servers.net A
net NS my-server
Forged responses(same IP addr, port, ID, Question section
different RCODE, different Authority)

Copyright © 2014 Japan Registry Services Co., Ltd.

8

Attack example:root-servers.net
Only when “net NS” is not cached by victim full resolvers
Full resolver port P
a.root-servers.net port 53
ID mmm, Query(random).root-servers.net ATrigger query[a-m].root-servers.net

Src addr/port
Dest addr/port“.” and root-servers.net
2
DNS header
3
a.root-servers.net port 53
QuestionFull resolver port P
Authority

Full resolver(Cache)
8Attacker port any
Full resolver port 53
ID any, Query(random).root-servers.net A

root-servers.net NS
is not cachedroot-servers.net NS
may be accepted1
my-serverroot-servers.net zone*.root-servers.net A

ID mmm, Response, rcode 3(random).root-servers.net A
root-servers.net SOA

Attacker

Before ③, send forged responses
a.root-servers.net port 53
Full resolver port P
ID mmm, Response, rcode 0(random).root-servers.net A
root-servers.net NS my-server
Forged responses(same IP addr, port, ID, Question section
different RCODE, different Authority)

Copyright © 2014 Japan Registry Services Co., Ltd.

9

Attack example:co.uk
Full resolver port P
ns1.nic.uk port 53
ID mmm, Query(random).co.uk ATrigger querySrc addr/port
Dest addr/port
4
DNS header
5Question
Authority

Full resolver(Cache)8

Attacker port any
Full resolver port 53
ID any, Query(random).co.uk A

co.uk NSis not cacheduk and co.uk
ns1.nic.uk port 53
Full resolver port P
ID mmm, Response, rcode 3(random).co.uk A
co.uk SOA

co.uk NS
may be accepted

1my-serverco.uk zone*.co.uk A 192.2.0.2[1-d].nic.uk

Attacker

Before ⑤, send forged responses
ns1.nic.uk port 53
Full resolver port P
ID mmm, Response, rcode 0(random).co.uk A
co.uk NS my-server
Forged responses(same IP addr, port, ID, Question section
different RCODE, different Authority)

Copyright © 2014 Japan Registry Services Co., Ltd.

10

Attack success probability andexpected value of attack time
Variable Unit
ValuesExample values
Num of resolver’s ports 𝑁𝑝𝑜𝑟𝑡
1 or 64,000
1~216
Num of IDs
65,536𝑁𝑞𝑖𝑑
216
Num of auth servers
4𝑁𝑛𝑠
1~13
RTT to auth servers
second0.039
𝑇𝑎𝑢𝑡ℎ0.001~0.2
Loop time
second𝑇𝑙𝑜𝑜𝑝
0.020
Response send rate
𝑅𝑎𝑛𝑠 packets/sec
100,000• Success probability of first time trial

𝑇𝑎𝑢𝑡ℎ ∗ 𝑅𝑎𝑛𝑠
𝑃=𝑁𝑞𝑖𝑑 ∗ 𝑁𝑝𝑜𝑟𝑡 ∗ 𝑁𝑛𝑠

Example:0.0148
Or0.00000023• Success probability under continuation attack is 1• Expected attack time
Example:𝑁𝑞𝑖𝑑 ∗ 𝑁𝑝𝑜𝑟𝑡 ∗ 𝑁𝑛𝑠 2.62 seconds
Or𝑇=167,772 (2 days)
𝑅𝑎𝑛𝑠
11Copyright © 2014 Japan Registry Services Co., Ltd.

My attack tool
• Written in C, 500 lines, standard library only
– Using select() to control timing and sockets– Send forged responses using raw socket• Tool’s parameters– Victim resolver’s IP address and port number– Trigger domain name
– NS RR information– Authoritative servers’ IP address list• Usage example– ./a.out 192.2.0.2 20001 www.google.com
www.google.com ns.dnslab.jp
216.239.32.10/216.239.34.10/216.239.36.10/216.2
39.38.10
Copyright © 2014 Japan Registry Services Co., Ltd.

12

Diagram of the attack tool
Initialization
prepare two sockets
UDP and Raw
Initialize timer
Send first trigger query

Send trigger query
generate (random) label
send “(random).$Trigger
A“ queries to victim resolver

Loop
selectIf readable,
receive response
if success --> Termination
if fail --> Send trigger query
After Tloop, Send trigger queryIf writable to raw socket,
send forged responses
Termination
Display the results

Attacker address port any
Full resolver port 53
ID any, Query(random).$Trigger A

Send forged responses
generate random ID
choose authoritative server addressfrom address-list
Question Section is the same as
sent trigger query
Authority Section is forged NS RR
from auth port 53 to victim resolver
send packet using Raw socket
Auth server address port 53
Full resolver port P
ID random, Response, rcode 0(random).$Trigger A
Injecting NS RR

Copyright © 2014 Japan Registry Services Co., Ltd.

13

Environment of attack experiments
1Gbps
ethernet

Attacker

VictimFull Resolver(BIND 9 orUnbound)

RouterTheInternet• Two VMs (Attacker and Victim)– 2.5GHz Xeon, 2 cpu, 3GB memory– On same link (1Gbps)– Victim full resolver sends queries to the Internet• Victim full resolver– BIND 9.9.5 (without source port randomization)– (Unbound 1.4.21 without source portrandomization)
Copyright © 2014 Japan Registry Services Co., Ltd.

14

Two attack experiments• www.google.com– % sudo ./a.out 203.178.129.2 20001
www.google.com www.google.com ns.dnslab.jp
216.239.32.10/216.239.34.10/216.239.36.10/216.2
39.38.10– The injection took 46 seconds,– 28 qps queries and 66,726 pps forged responses• net– “rndc flush” on victim full resolver– sudo ./a.out 203.178.129.2 20001 root-servers.net
net ns.dnslab.jp 198.41.0.4/192.228.79.201/…(rootserver addresses)– The injection took 8 seconds,– 30 qps queries and 69,158 pps forged responses
Copyright © 2014 Japan Registry Services Co., Ltd.

15

Expected attack time and results
Var. Unit Range
Port randomization
Num of resolver
Nport
ports
Num of IDs
Nqid
Num of auth servers Nns
RTT to auth servers Tauth sec
Loop interval
Tloop sec
Response send rate Rans pps
First time trial
Success possibility
expected attack timesec
Attack time (result)sec

1~2^162^16
1~13

www.google.com
net attack
attacknoyes
noyes

1 64,000
65536
4

←
←

0.001 0.036~~0.2 0.094

←

0.036
66726

←
←
0.00000
0.00916014
3.9 251,434
46 ×

Copyright © 2014 Japan Registry Services Co., Ltd.

1 64,000
65536
130.006~
0.272

←
←
←

0.033
69158

←←
0.00000
0.00267004
12.3 788,425
8 ×
16If you detect poisoning
1. Flush poisoned RRSet
2. Resolve the poisoned RRSet
3. Compare the poisoned RRSet with otherfull resolvers– Your other full resolvers– Or, public DNS services (for example:Google)– Because cache flush may cause anotherpoisoning
Copyright © 2014 Japan Registry Services Co., Ltd.

17

Measures• Source port randomization• Monitoring– Attacks may increase victim full resolver’s load
– Traffic• Number of packets of input and output are usually balanced onDNS• Victim full resolver receives many unmatched responses• Many countermeasures are proposed/implemented– harden-referral-path on Unbound– nonce prefix on Google Public DNS– Use of TCP transport– DNS cookies• See also
– draft-fujiwara-dnsop-poisoning-measures-00
Copyright © 2014 Japan Registry Services Co., Ltd.

18

Detection by DNSSEC validation• Cache poisoning is possible on BIND 9 and Unboundvalidators• However, DNSSEC validation works well and they
return validation error as “Server Failure”• NSEC3 Opt-Out issue– Complex structured TLDs may have empty non-terminals– Empty non-terminals with NSEC3 are able to be validated
because NSEC3 RRs say no NS– Some empty non-terminals do not have NSEC3 RRs• When there is no secure delegation for the name• One example: saitama.jp• They were not able to be validated– So, JPRS added TXT RRs to all empty non-terminals inJP zone
• BIND 9’s dnssec-signzone generates NSEC3 RRs for non-empty
non-terminals
Copyright © 2014 Japan Registry Services Co., Ltd.
19Conclusion• "Redirect the target domain's nameserver“
cache poisoning attack is easy
– Most of domain names are conquerable– However, it is easy to trace attackers because itneeds authoritative DNS servers• Measures– Source port randomization works well
– DNSSEC validation is effective to detect– Detection and correspondence of attacks areimportant
Copyright © 2014 Japan Registry Services Co., Ltd.

20

details

Copyright © 2014 Japan Registry Services Co., Ltd.

21

Success probability of first time trial• Success if ID, port, address are matched• Probability of first time trial 𝑃 is probability
within 𝑇𝑎𝑢𝑡ℎ𝑇𝑎𝑢𝑡ℎ ∗ 𝑅𝑎𝑛𝑠
𝑃=𝑁𝑞𝑖𝑑 ∗ 𝑁𝑝𝑜𝑟𝑡 ∗ 𝑁𝑛𝑠• However, 𝑇𝑎𝑢𝑡ℎ is not controllable• Use 𝑇𝑙𝑜𝑜𝑝 instead of 𝑇𝑎𝑢𝑡ℎunder 𝑇𝑙𝑜𝑜𝑝 < 𝑇𝑎𝑢𝑡ℎ𝑇𝑙𝑜𝑜𝑝 ∗ 𝑅𝑎𝑛𝑠
𝑃=𝑁𝑞𝑖𝑑 ∗ 𝑁𝑝𝑜𝑟𝑡 ∗ 𝑁𝑛𝑠
Copyright © 2014 Japan Registry Services Co., Ltd.

22

Success probability undercontinuation attack• Success probability of not succeeding by𝑛 − 1𝑠𝑡 time, but succeeding n-th time𝑃𝑛 = 1 − 𝑃 𝑛−1 ∗ 𝑃(1)• Success probability of succeeding by 𝑛-thtime 𝑄𝑛 is the sum of 𝑃𝑛
𝑄𝑛 = 𝑛𝑖=1 1 − 𝑃 𝑖−1 𝑃(2)𝑄𝑛 = 1 − 1 − 𝑃 𝑛(3)• 𝑛 is brought close to infinity
𝑄𝑛 → 1
Copyright © 2014 Japan Registry Services Co., Ltd.

23

Expected attack number of tries• Success probability of not succeeding by 𝑛 − 1𝑠𝑡time, but succeeding n-th time𝑃𝑛 = 1 − 𝑃 𝑛−1 ∗ 𝑃(1)• Expected attack number of tries by 𝑛-th time 𝐸𝑛 isa sum of the multiply of value 𝑖 and 𝑃𝑛
𝐸𝑛 = 𝑛𝑖=1 𝑖 1 − 𝑃 𝑖−1 𝑃(2)• Then1(1+𝑛𝑃) 1−𝑃 𝑛
𝐸𝑛 = −𝑃𝑃(3)• 𝑛 is brought close to infinity
1
𝐸𝑛 →𝑃

Copyright © 2014 Japan Registry Services Co., Ltd.

24

Expected attack time
𝑇 = 𝑇𝑙𝑜𝑜𝑝 ∗ 𝐸𝑇𝑙𝑜𝑜𝑝=𝑃𝑁𝑞𝑖𝑑 ∗ 𝑁𝑝𝑜𝑟𝑡 ∗ 𝑁𝑛𝑠=𝑅𝑎𝑛𝑠

Copyright © 2014 Japan Registry Services Co., Ltd.

25

Termination of attack• Prepare “*.$Trigger IN A 192.2.0.1” onforged authoritative DNS server• If the NS injection succeed, a response ofa trigger query returns rcode 0,“(random).$D IN A” RR

Copyright © 2014 Japan Registry Services Co., Ltd.

26