[Paper Review] XDRI Attacks - and - How to Enhance Resilience of Residential Routers

Philipp Jeitner, Haya Shulman+2 more|arXiv (Cornell University)|Aug 25, 2022

Internet Traffic Analysis and Secure E-voting4 citations

TL;DR

This paper introduces XDRI (Cross-DNS Router Injection) attacks that exploit improper handling of special characters in DNS records to poison residential router caches, enabling off-path DNS cache poisoning. The authors evaluate 36 popular routers, finding 10 vulnerable to cache injection and 15 with circumvented defenses; they propose removing DNS functionality from routers to eliminate these vulnerabilities, arguing performance costs are negligible due to short TTLs and ISP resolver proximity.

ABSTRACT

We explore the security of residential routers and find a range of critical vulnerabilities. Our evaluations show that 10 out of 36 popular routers are vulnerable to injections of fake records via misinterpretation of special characters. We also find that in 15 of the 36 routers the mechanisms, that are meant to prevent cache poisoning attacks, can be circumvented. In our Internet-wide study with an advertisement network, we identified and analyzed 976 residential routers used by web clients, out of which more than 95% were found vulnerable to our attacks. Overall, vulnerable routers are prevalent and are distributed among 177 countries and 4830 networks. To understand the core factors causing the vulnerabilities we perform black- and white-box analyses of the routers. We find that many problems can be attributed to incorrect assumptions on the protocols' behaviour and the Internet, misunderstanding of the standard recommendations, bugs, and simplified DNS software implementations. We provide recommendations to mitigate our attacks. We also set up a tool to enable everyone to evaluate the security of their routers at https://xdi-attack.net/.

Motivation & Objective

• To identify and analyze critical vulnerabilities in residential routers that enable off-path DNS cache poisoning attacks.
• To evaluate the prevalence and impact of these vulnerabilities across global networks and router models.
• To investigate root causes of vulnerabilities, including protocol misinterpretations, implementation bugs, and flawed security mechanisms.
• To propose a paradigm shift: removing DNS functionality from routers to enhance long-term resilience.
• To provide actionable recommendations and a public tool (xdi-attack.net) for users to test their router security.

Proposed method

• Conducted black-box testing on 36 widely deployed residential routers to assess susceptibility to XDRI attacks using specially crafted DNS records with encoded special characters.
• Performed white-box firmware analysis on vulnerable routers and examined open-source DNS implementations from GitHub to identify root causes of vulnerabilities.
• Evaluated the effectiveness of standard defenses such as DNSSEC, source port randomization, and TXID randomization, demonstrating their circumvention via entropy reduction techniques.
• Conducted an Internet-wide study using an advertisement network to identify and analyze 976 residential routers, measuring real-world exposure.
• Proposed a new architectural approach: eliminating DNS forwarding in routers by redirecting DNS queries directly to ISP resolvers via firewall rules.
• Developed and deployed a public tool at xdi-attack.net to enable users to test their router's vulnerability to XDRI attacks.

Experimental results

Research questions

• RQ1 What are the root causes of DNS cache poisoning vulnerabilities in residential routers, particularly those related to special character handling?
• RQ2 To what extent are popular residential routers vulnerable to off-path DNS cache poisoning via encoded injections?
• RQ3 Can standard defenses like DNSSEC, port randomization, and TXID randomization be effectively circumvented in real-world router implementations?
• RQ4 What are the performance and security trade-offs of removing DNS functionality from residential routers?
• RQ5 How prevalent are these vulnerabilities across global networks and geographies?

Key findings

• Out of 36 popular routers tested, 10 were vulnerable to XDRI attacks due to misinterpretation of special characters in DNS records.
• In 15 of the 36 routers, mechanisms meant to prevent cache poisoning—such as DNSSEC and randomization—could be circumvented, exposing them to attack.
• An Internet-wide study identified 976 residential routers in use by web clients, with over 95% found vulnerable to XDRI attacks, spanning 177 countries and 4,830 networks.
• The root causes of vulnerabilities include incorrect assumptions about network behavior, misunderstandings of standards, implementation bugs, and simplified DNS software.
• The study found that 8% of devices with open DNS forwarders and 95% of devices with non-open forwarders were vulnerable, indicating widespread exposure.
• The paper concludes that removing DNS functionality from routers is a viable, low-cost solution that eliminates injection and entropy-related vulnerabilities while incurring negligible performance overhead due to short TTLs and ISP resolver proximity.