Protecting against DNS cache poisoning attacks

Abstract

DNS is vulnerable to cache poisoning attacks, whereby an attacker sends a spoofed reply to its own query. Historically, an attacker only needed to guess a predictable, or more recently, a 16 bit pseudorandom ID in order to be successful. The Kaminsky attack [7] demonstrated successful poisoning attacks that required only 6 seconds on typical networks. Since then, source port randomization (spr) has been used for additional protection. Nevetheless, E. Polyakov demonstrated successful poisoning attacks against spr given a Gigabit network, on the order of 10 hours. Even with slower network speeds, an attack is likely to be successful in a moderate time period. DNSSEC [3] will provide a strong countermeasure to poisoning as well as other attacks against the DNS. However, until DNSSEC is actually deployed, there is a need for additional countermeasures that can be deployed in the near term. In this paper, we describe a new approach that is based on detecting a poisoning attack, then sending an additional request for the same DNS Resource Record. Since the defense is only activated when attacks occur, we expect the performance impact to be minimal. The countermeasure requires no changes to the DNS standards, and only requires modifications to the caching server. Thus it can be deployed incrementally in order to obtain immediate security benefits. We show that our proposed defense makes poisoning attacks substantially more difficult. We have implemented the countermeasure using a local proxy for the BIND caching server, and our tests show that the performance impact is minimal.

Survey on cyberspace security

“…Application attacks mainly focus on the aggregation layer and the application layer, including attacks against the application server and malware intrusions. Attacks against the application server include DOS and DNS cache poisoning [185]. Deployment of a firewall and configuration of security policy can protect the application server from network attacks.…”

Prevent DNS Cache Poisoning Using Security Proxy

“…The success attack probability of the SRQ and the SLC in different threat level According to formula (1) and (2), both the SRQ and SLC mode will significantly reduce the success attack probability when the parameter R in (1) and L in (2) increases, and under the SRQ mode the p succ even reduce faster because of the K in (1) is much greater than 36 in (2). As shown in Fig.5, the curve of SRQ descends faster than the SLC before the two curves intersect.…”

“…Assume that the attacker guesses N guess times before he find the right answer, as we computed in (1) and (2), the expectation of the number N guess that the attacker needs to send the packets equals to the reciprocal of the success attack probability, which is 1/ p succ . So the total time expectation should be computed by the packet length, his bandwidth and the N guess , then:…”

“…People tried to find ways to enhance the security of DNS and get some improvement [1][2][3][4][5][6][7][8][9][10][11][12]. First widely used strategy is transaction ID randomizing [10].…”

网络空间安全综述

“…针对服务应用的攻击主要集中在汇聚层和应用层, 主要包含针对应用服务器的网络攻击和恶意 软件入侵. 针对应用服务器的攻击包括 DoS 攻击, 以及针对特定协议的攻击, 如 DNS 缓存投毒 [187] . 通过部署防火墙, 配置安全策略, 即可保护应用服务器抵御网络攻击.…”