MaginotDNS

Introduction

MaginotDNS is a powerful cache poisoning attack against DNS servers that simultaneously act as recursive resolvers and forwarders (termed as CDNS). The attack is made possible through exploiting vulnerabilities in the bailiwick checking algorithms, one of the cornerstones of DNS security since the 1990s, and affects multiple versions of popular DNS software, including BIND and Microsoft DNS.

Through field tests, we find that the attack is potent, allowing attackers to take over entire DNS zones, even including Top-Level Domains (e.g., .com and .net). Through a large-scale measurement study, we also confirm the extensive usage of CDNSes in real-world networks (up to 41.8% of our probed open DNS servers) and find that at least 35.5% of all CDNSes are vulnerable to MaginotDNS. After interviews with ISPs, we show a wide range of CDNS use cases and real-world attacks.

We have reported all the discovered vulnerabilities to DNS software vendors and received acknowledgments from all of them. 3 CVE-ids have been published, and 2 vendors have fixed their software. Our study brings attention to the implementation inconsistency of security checking logic in different DNS software and server modes (i.e., recursive resolvers and forwarders), and we call for standardization and agreements among software vendors.

Publications

Xiang Li, Chaoyi Lu, Baojun Liu, Qifan Zhang, Zhou Li, Haixin Duan, and Qi Li. The Maginot Line: Attacking the Boundary of DNS Caching Protection. In Proceedings of the 32nd USENIX Security Symposium (USENIX Security ‘23). Anaheim, California, August 9–11, 2023. [PDF] [Slides] [Video] [Code]

(Acceptance rate: 422/1,444=29.2%, Acceptance rate in summer: 91/388=23.5%, Acceptance rate in fall: 155/531=29.2%), Acceptance rate in winter: 176/525=33.5%)

PoC

👀 Proof of Concept

On-path Attack of Microsoft DNS: Attack video.
Off-path Attack of Microsoft DNS: Attack video.
On-path Attack of BIND: Attack video.
Off-path Attack of BIND: Attack video.
On-path Attack of Knot Resolver: Attack video.

CVEs

🐞 Total (3)

Tools

🔧 XMap: The Internet Scanner

XMap is a fast network scanner designed for performing Internet-wide IPv6 & IPv4 network research scanning.

Presentations

🎙️ Presentations

Presented in Black Hat USA 2023
Presented in SHUZIHUANYU Talk
Presented in KANXUE 2023 SDC
Presented in Black Hat Webinar

News

🆕 News & CERT

60+ news coverage by media such as BleepingComputer and APNIC
An Austria government CERT daily report
A Sweden government CERT weekly news
A Bournemouth University (BU) CERT news

🆕 News & CERT List

AlienVault: News
All InfoSec News: News
Altus Intel: News
Anti-Malware.ru: News
APNIC: News
BelEn News and Lifestyle: News
BleepingComputer: News
Blog elhacker.NET: News
Bournemouth University (BU) CERT on 15/08/2023: News
BreachForums: News
Broadband Reports: News
CICESE: News
CaveiraTech: News
Cyber Reports: News
CyberIQs: News
Cyware Labs: News
Desde Linux: News
DevBytes: News
Facebook: News
Fagen Wasanni Technologies: News
First Hackers News: News
FreeFlarum: News
GovCERT Austria on 14/08/2023: News
Hispasec UnaAlDia: News
How 2 Do: News
ITSec.Ru: News
IlSoftware.it: News
Informazione.it: News
Infosec Exchange: News
Italy 24 Press News: News
Jetico: News
MalwareTips: News
Menéame: News
News YCombinator: News
Notizie today: News
OpenNet: News
OpenSecurity: News
PRSOL:CC: News
Red Hot Cyber: News
Reddit: News
Risky Biz: News
SNAS Internet Storm Center: News
SecNews.gr: News-zh-cn
SecNews.gr: News
Secure Hunter: News
Security Lab: News
SecurityWeek: News
Sweden CERT on 18/08/2023: News
TS2 Space: News
TechWar.GR: News
UPV/EHU: News
Una al Día: News
Vumetric Cyber Portal: News
carder.uk: News
e-security.bg: News
lasgasolineras.es: News
notizie.today: News
techxpub.de: News
360CERT安全日报（2023.08.14）: News
合天网安实验室-网络安全日报（2023年08月15日）: News
快米云: News
資安日報: News