By Chris Racki

Outline  Introduction  How DNS works  A typical DNS lookup  Caching for later  Vulnerabilities of DNS  Anatomy of a cache poisoning  Why isn’t the security community panicked  Ok, now they’re panicked!  Mitigation  Conclusion

Introduction  Computers navigate the internet using DNS  Common requests are cached  Caching makes DNS vulnerable  When a DNS is poisoned any IP can be set to any internet address  The fix is in the chaos

How DNS Works Root Servers... Top Level Domain Servers.com.org.net.com.gov.edu.net google.com montclair.edu

A Typical DNS Lookup ISP DNS User 1. what’s the IP for Root Server.com Server google.com Server 2. what’s the IP for 3. Server Referral 4. what’s the IP for 5. Server Referral 6. what’s the IP for 7. The IP is XXX.XXX.XXX 9. The IP is XXX.XXX.XXX 10. Go to 8. Cache result

Vulnerabilities ISP DNS User 1. what’s the IP for Root Server.com Server google.com Server 2. what’s the IP for 3. Server Referral 4. what’s the IP for 5. Server Referral 6. what’s the IP for 7. The IP is XXX.XXX.XXX 8. The IP is XXX.XXX.XXX 10. Go to Cached result Go to

Anatomy of a Cache Poisoning WWhat’s the IP for IIt’s not in my cache, I have to look it up. NNow that he’s waiting for a response, it’s my chance! UUnsolicited reply… ignore. FForged reply is accepted and cached. ?... Query ID Lookup Request Forged Lookup Reply Query ID Query ID Query ID 10020Query ID forged reply

Why isn’t the security community panicked?  Attack only works when entry is not in cache  Hard to predict exactly when Time To Live will expire  Limited chances for attack

Ok, now they’re panicked!  In 2008 Dan Kaminsky improved the attack.  Attack is only possible when target is not in cache.  is almost always in the cache.  fake01.google.com is never in cache so it always triggers a lookup.  Instead of forging a single page, forge the google.com DNS server.  Now all requests for google.com domain can be redirected to attacker’s DNS server.

A More Toxic Poison ISP DNS Root Server.com Server google.com Server what’s the IP for fake01.google.com? Server Referral what’s the IP for fake01.google.com? Server Referral Forge the IP of the google.com domain DNS server Response is too slow

What’s the fix?  Make the query ID more random  Older DNS software use sequential query IDs or easily predicted random query IDs  Randomize the port and change it often  Older DNS software always uses one port

Conclusion  DNS cache poisoning is not new  There are new ways to use it  A successful DNS poisoning could be very damaging  Be alert of new threats  Thank you