DNS cache poisoning, the Internet attack from 2008, is back from the dead
arstechnica.com
arstechnica.com
1. Attacks on forwarders are neutralized by things like DoH, and it's not clear how generalizable their results are (it's not clear whether they need insider collaboration to pull off the attacks).
2. It appears to be possible to defeat attacks on the major public DNS caches with just slight tweaks to ICMP unreachable messages. Like, couldn't you just drop a random ICMP packet or two within the rate window and completely jank this attack up?
It's not strictly required, and leaks information. I don't know what an dns server would do with an icmp unreachable to its reply anyway.
Random drop would work too of course. I think there's a general concern about these rate limits leaking information, but it's hard to address because of many concerns. Alternatively a big push to use lots of IPv6 addresses would increase the search space and make it harder to spoof (contingent on IPv6 support in authoritative and recursive severs and their networks)
If you worry about DNS cache poisoning, sign your domains and validate the responses you get.
I run it on an old laptop running FreeBSD and have my other machines use it as their DNS server.
See https://sockpuppet.org/blog/2015/01/15/against-dnssec/ for more.
BTW, there are nearly 13 million DNSSEC signed zones; the trend is certainly up [2].
Does DNSSEC mitigate the attack?
Yes and no, the server must implement strict DNSSEC check (i.e., refuse the responses that break the trust chain) to prevent the off-path attacks. However, since DNSSEC is still under development and servers need to accept such responses (i.e., only DNSSEC aware but not DNSSEC validate) when visiting a misconfigured domain.
Nobody is debating whether DNSSEC addresses this attack --- it does, for server-to-server connections. But DNSSEC is an extremely expensive way to stop this attack, and because there are cheaper ways that don't require collaboration between unrelated parties on the Internet, those are the mitigations --- ICMP policy changes, 0x20 encoding, DNS cookies, etc --- that will happen.
DNSCURVE was explicit about the idea of doing bottom-up protection of the whole DNS, so that servers would use it with other servers. You can, of course, do that with DoH as well, but it's not an "indicated use" yet.
So the short answer is: DoH & friends break this attack completely against home router forwarders (the first target in the paper), but not for major public resolvers like 8.8.8.8; they'll need to take some steps to break it themselves.