DNS Cache Poisoning by Christopher Makarem

Examples of DNS Cache Poisoning

Blind Response Forgery with Birthday Attack
A DNS protocol exchange does not authenticate responses to recursive iterative queries. The only checks to validate the query are the 16-bit transaction ID and the source IP address and destination port of the response packet. Before 2008, all DNS revolvers used fixed port 53. Therefore with the exception of the transaction ID, all information necessary to spoof a DNS reply is predictable. Attacks on DNS exploiting this weakness are known as the “birthday paradox” and on average take ²⁸ or 256 attempts to guess the transaction ID. For the attack to succeed, the forged DNS reply must arrive at the target resolver before the legitimate authoritative response does. If the legitimate response arrives first, it will be cached by the resolver, and until its time-to-live (TTL) expires, the resolver will not ask the authoritative server to resolve the same domain name, preventing the attacker from poisoning the mapping for that domain until the TTL expires.

Kaminsky Exploit
An extension of the Birthday Attack was revealed at Black Hat 2008, where the basic blind guessing technique remains the same. The attack exploits the underlying nature of DNS responses in that a DNS response can be an answer (the direct IP address of the request) or a referral (the server that is authoritative over a given zone). The Birthday Attack forges an answer that injects a false entry for a given domain record. The Kaminsky exploit utilizes a referral to make a false entry for an entire domain bypassing TTL on previous entries. The basic idea is that the attacker chooses the domain that they wish to compromise and then queries the target resolver for a sub-domain which is not already cached by the resolver (Targeting non-existent sub-domains is a good bet that the record is not cached by the DNS resolver). Since the sub-domain is not in the cache, the target resolver sends a query to the authoritative server for that domain. It is at this point that the attacker floods the resolver with a large number of forged responses, each with a different forged transaction ID number. If the attacker is successful in the injection of the forged response, then the resolver will cache a false mapping for an authoritative server. Future DNS queries to the target resolver of the compromised domain will result in all requests being forwarded to the attacker controller authoritative resolver enabling the attacker to provide malicious responses without a need to inject fake entries for each new DNS record.

Eavesdropping
Many new proposals for enhancing DNS security include source port randomization, 0x20 XOR encoding, WSEC-DNS, all depend on the asymmetrical accessibility of the components used for authentication. In other words, they provide security through obscurity rather than confidentiality through authentication and cryptography. Their only goal is to prevent BLIND attacks as discussed above. Using these security methods still leaves DNS vulnerable to trivial attacks of compromised servers and network eavesdroppers to break the obscurity and perform the same attacks as seen above, this time without blind guessing. Even in switched environments, ARP poisoning and similar techniques can be used to force all packets to a malicious computer and can defeat the obscurity.