[Paper Review] Unilateral Antidotes to DNS Cache Poisoning

Amir Herzberg, Haya Shulman|arXiv (Cornell University)|Sep 7, 2012

Internet Traffic Analysis and Secure E-voting3 citations

TL;DR

This paper proposes two unilateral defenses—'sandwich antidote' and 'NAT antidote'—to prevent DNS cache poisoning without requiring changes to DNS resolvers. The sandwich antidote detects and blocks poisoning attempts in two phases, while the NAT antidote increases entropy by rotating the resolver's source IP address. Both can be deployed at gateways, offering strong protection against spoofing attacks with minimal overhead.

ABSTRACT

We investigate defenses against DNS cache poisoning focusing on mechanisms that can be readily deployed unilaterally by the resolving organisation, preferably in a single gateway or a proxy. DNS poisoning is (still) a major threat to Internet security; determined spoofing attackers are often able to circumvent currently deployed antidotes such as port randomisation. The adoption of DNSSEC, which would foil DNS poisoning, remains a long-term challenge. We discuss limitations of the prominent resolver-only defenses, mainly port and IP randomisation, 0x20 encoding and birthday protection. We then present two new (unilateral) defenses: the sandwich antidote and the NAT antidote. The defenses are simple, effective and efficient, and can be implemented in a gateway connecting the resolver to the Internet. The sandwich antidote is composed of two phases: poisoning-attack detection and then prevention. The NAT antidote adds entropy to DNS requests by switching the resolver's IP address to a random address (belonging to the same autonomous system). Finally, we show how to implement the birthday protection mechanism in the gateway, thus allowing to restrict the number of DNS requests with the same query to 1 even when the resolver does not support this.

Motivation & Objective

• To address the ongoing threat of DNS cache poisoning despite existing defenses like port randomization and 0x20 encoding.
• To provide practical, deployable defenses that require no changes to DNS resolvers or widespread deployment of DNSSEC.
• To enhance security by increasing entropy and detecting poisoning attempts at the network gateway level.
• To offer immediate, effective protection against determined attackers who can bypass standard resolver-only defenses.

Proposed method

• The sandwich antidote operates in two phases: first detecting poisoning attempts via response validation, then blocking further malicious responses.
• The NAT antidote increases source IP entropy by assigning the resolver a random IP address from a pool within the same autonomous system.
• Birthday protection is implemented at the gateway to limit duplicate DNS requests for the same resource record to one.
• The gateway maintains a table of outbound DNS requests and forwards only the first response for each query, discarding subsequent duplicates.
• The system uses firewall rules to capture and queue DNS packets on port 53, enabling real-time processing and response crafting.
• A proof-of-concept implementation demonstrates that the gateway can craft matching responses for all pending requests, ensuring consistent resolution.

Experimental results

Research questions

• RQ1 Can effective, unilateral defenses against DNS cache poisoning be implemented without modifying DNS resolvers or relying on DNSSEC?
• RQ2 How can gateway-level mechanisms detect and prevent poisoning attacks when resolver-level protections are bypassed?
• RQ3 What level of entropy increase can be achieved through source IP randomization at the gateway, and how does it impact attack feasibility?
• RQ4 Can birthday protection be effectively enforced at the gateway to prevent the birthday paradox-based attack vector?
• RQ5 How can the gateway distinguish legitimate responses from forged ones while maintaining low latency and high throughput?

Key findings

• The sandwich antidote successfully detects and blocks DNS cache poisoning attempts by validating response fields and discarding subsequent responses for the same query.
• The NAT antidote increases the effective entropy of DNS requests by a factor of up to 2^11 by rotating the source IP address from a pool of available addresses.
• Implementing birthday protection at the gateway prevents duplicate queries from being processed, effectively neutralizing the birthday paradox attack vector.
• The gateway-based birthday protection mechanism can restrict concurrent requests for the same resource record to one, even when the resolver does not support this feature.
• The proposed defenses are simple, efficient, and can be deployed in existing network infrastructure without requiring changes to DNS resolvers or widespread DNSSEC adoption.
• Proof-of-concept code demonstrates that the gateway can craft and forward matching responses for all pending requests, ensuring consistent and secure DNS resolution.