DNS Cache Poisoning Detection at the end-user level

Caches DNS : tree of domain name

Caches DNS : tree of domain name Into DNS server TLDs ISPs, local Corporate

Caches DNS : tree of domain name Into DNS server TLDs ISPs, local Corporate In end-user computer's System cache (hosts) Browser cache (client)

DNS request Every time you try to reach a domain name

DNS request Every time you try to reach a domain name Identified by: Destination Topic (domain in the request) Port number Transaction number

DNS request Every time you try to reach a domain name Identified by: Destination Topic (domain in the request) Port number Transaction number Destination can be spoofed Topic is the target Port number is almost always 53 Transaction number can be guessed Birthday paradox

Poison: A Firefox extension XUL HTML-like Merging (Overlay) Modifiable using JavaScript

Overlay: Merging XUL documents <?xul-overlay href="chrome://.../editMenuOverlay.xul"?> <menupopup id="menu_FilePopup" onpopupshowing="AreaFrameCount();"> <?xml-stylesheet href="chrome://poison/content/info.css" ?> <script src="chrome://poison/content/poison.js" />...

Overlay: Merging XUL documents <?xul-overlay href="chrome://.../editMenuOverlay.xul"?> <menupopup id="menu_FilePopup" onpopupshowing="AreaFrameCount();"> <?xml-stylesheet href="chrome://poison/content/info.css" ?> <script src="chrome://poison/content/poison.js" />...

Poison: A Firefox extension XUL HTML-like Merging (Overlay) Modifiable using JavaScript JavaScript Object oriented High level Interpreted

JavaScript: Modifying content From DB Script: var dbzone = document.getElementById("db_traceroute"); dbzone.firstChild.nodeValue = result; db.setAttribute("hidden", "false");

Poison: A Firefox extension JavaScript Object oriented High level Interpreted XUL HTML-like Merging (Overlay) Modifiable using JavaScript XUL + JS + Firefox Event-driven UI is simple Simple modification of UI using JS Easy to do network request SQLITE provided

Verifications : Generalities For every test First time Obtain the informations (test dependent) Store the result of the test into the database for future comparison

Verifications : Generalities For every test First time Obtain the informations (test dependent) Store the result of the test into the database for future comparison Every other time Obtain the informations Compare them with what is store in the database for the same website Extract a similarity score

Verification : Similarity score Take the data from the BDD Compare with the data we just obtained No fingerprint Complete text data Use more space, but also more reliable Compare line by line

Project : Poison Window / Panel Address bar & status bar Demo : Firefox portable version on USB drive

Results From March 31 th to April 5 th 15 websites 6 tests every 30 minutes test entries

Results : global average (without poisoning)

Results : Tests description Comparing IP to the IP stored in the database

Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request

Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request Error page Access a nonexistent page

Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request Error page Access a nonexistent page Traceroute

Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request Error page Access a nonexistent page Traceroute Reverse DNS Get the domain names corresponding to an IP address

Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request Error page Access a nonexistent page Traceroute Reverse DNS Get the domain names corresponding to an IP address WHOIS Get informations about who own the domain name,...

Results : Average by test

Attack simulation Modify hosts file (/etc/hosts) Poisoned the April 4 th at 9pm

Results : Attack ! /etc/hosts modified the April 4 th at 9PM

Improvements The data could have more meaning Currently it is only dump comparison The request and the scoring could be automatic More usability