The Domain Name System (DNS) provides a translation between readable domain names and IP addresses. The DNS is a key infrastructure component of the Internet and a prime target for a variety of attacks. One of the most significant threat to the DNS's wellbeing is a DNS poisoning attack, in which the DNS responses are maliciously replaced, or poisoned, by an attacker. To identify this kind of attack, we start by an analysis of different kinds of response times. We present an analysis of typical and atypical response times, while differentiating between the different levels of DNS servers' response times, from root servers down to internal caching servers. We successfully identify empirical DNS poisoning attacks based on a novel method for DNS response timing analysis. We then present a system we developed to validate our technique that does not require any changes to the DNS protocol or any existing network equipment. Our validation system tested data from different architectures including LAN and cloud environments and real data from an Internet Service Provider (ISP). Our method and system differ from most other DNS poisoning detection methods and achieved high detection rates exceeding 99 . These findings suggest that when used in conjunction with other methods, they can considerably enhance the accuracy of these methods.
@cite_43: DNS caches are an extremely important tool, providing services for DNS as well as for a multitude of applications, systems and security mechanisms, such as anti-spam defences, routing security (e.g., RPKI), firewalls. Subverting the security of DNS is detrimental to the stability and security of the clients and services, and can facilitate attacks, circumventing even cryptographic mechanisms. We study the caching component of DNS resolution platforms in diverse networks in the Internet, and evaluate injection vulnerabilities allowing cache poisoning attacks. Our evaluation includes networks of leading Internet Service Providers and enterprises, and professionally managed open DNS resolvers. We test injection vulnerabilities against known payloads as well as a new class of indirect attacks that we define in this work. Our Internet evaluation indicates that more than 92 of the Internet's DNS resolution platforms are vulnerable to records injection and can be persistently poisoned.
@cite_43 focused on cache poisoning attacks. They investigated a new indirect attack where they injected the victim's cache with a poisonous record which does not immediately impact the resolution process, but rather becomes effective after an authentic record expires. In this case, the next resolution request to that name returns the spoofed record. Canonical NAME record (CNAME) is a type of resource record in the DNS used to specify that a domain name is an alias for another domain called the "canonical" domain. Delegation of the NAME record (DNAME) creates an alias for an entire subtree of the domain name tree. They injected CNAME and DNAME responses in a cache poisoning attack.