1. DNS Cache Poisoning Detection at the end-user level

2. Caches DNS : tree of domain name

3. Caches DNS : tree of domain name Into DNS server TLDs ISPs, local Corporate

4. Caches DNS : tree of domain name Into DNS server TLDs ISPs, local Corporate In end-user computer's System cache (hosts) Browser cache (client)

5. DNS request Every time you try to reach a domain name

6. DNS request Every time you try to reach a domain name Identified by: Destination Topic (domain in the request) Port number Transaction number

7. DNS request Every time you try to reach a domain name Identified by: Destination Topic (domain in the request) Port number Transaction number Destination can be spoofed Topic is the target Port number is almost always 53 Transaction number can be guessed Birthday paradox

8. Poison: A Firefox extension XUL HTML-like Merging (Overlay) Modifiable using JavaScript

9. Overlay: Merging XUL documents <?xul-overlay href="chrome://.../editMenuOverlay.xul"?> <menupopup id="menu_FilePopup" onpopupshowing="AreaFrameCount();">......... <?xml-stylesheet href="chrome://poison/content/info.css" ?> <script src="chrome://poison/content/poison.js" />...

10. Overlay: Merging XUL documents <?xul-overlay href="chrome://.../editMenuOverlay.xul"?> <menupopup id="menu_FilePopup" onpopupshowing="AreaFrameCount();">......... <?xml-stylesheet href="chrome://poison/content/info.css" ?> <script src="chrome://poison/content/poison.js" />...

11. Poison: A Firefox extension XUL HTML-like Merging (Overlay) Modifiable using JavaScript JavaScript Object oriented High level Interpreted

12. JavaScript: Modifying content From DB Script: var dbzone = document.getElementById("db_traceroute"); dbzone.firstChild.nodeValue = result; db.setAttribute("hidden", "false");

13. Poison: A Firefox extension JavaScript Object oriented High level Interpreted XUL HTML-like Merging (Overlay) Modifiable using JavaScript XUL + JS + Firefox Event-driven UI is simple Simple modification of UI using JS Easy to do network request SQLITE provided

14. Verifications : Generalities For every test First time Obtain the informations (test dependent) Store the result of the test into the database for future comparison

15. Verifications : Generalities For every test First time Obtain the informations (test dependent) Store the result of the test into the database for future comparison Every other time Obtain the informations Compare them with what is store in the database for the same website Extract a similarity score

16. Verification : Similarity score Take the data from the BDD Compare with the data we just obtained No fingerprint Complete text data Use more space, but also more reliable Compare line by line

17. Project : Poison Window / Panel Address bar & status bar Demo : Firefox portable version on USB drive

18. Results From March 31 th to April 5 th 15 websites 6 tests every 30 minutes 21 620 test entries

19. Results : global average (without poisoning)

20. Results : Tests description Comparing IP to the IP stored in the database

21. Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request

22. Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request Error page Access a nonexistent page

23. Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request Error page Access a nonexistent page Traceroute

24. Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request Error page Access a nonexistent page Traceroute Reverse DNS Get the domain names corresponding to an IP address

25. Results : Tests description Comparing IP to the IP stored in the database Check IP make a second DNS request Error page Access a nonexistent page Traceroute Reverse DNS Get the domain names corresponding to an IP address WHOIS Get informations about who own the domain name,...

26. Results : Average by test

27. Attack simulation Modify hosts file (/etc/hosts) Poisoned the April 4 th at 9pm

28. Results : Attack ! /etc/hosts modified the April 4 th at 9PM

29. Improvements The data could have more meaning Currently it is only dump comparison The request and the scoring could be automatic More usability