Encrypted DNS --> Privacy? A Traffic Analysis Perspective

Abstract

Virtually every connection to an Internet service is preceded by a DNS lookup. These lookups are performed in the clear without integrity protection, enabling manipulation, redirection, surveillance, and censorship. In parallel with standardization efforts that address these issues, large providers such as Google and Cloudflare are deploying solutions to encrypt lookups, such as DNS-over-TLS (DoT) and DNS-over-HTTPS (DoH). In this paper we examine whether encrypting DoH traffic can protect users from traffic analysis-based monitoring and censoring. We find that performing traffic analysis on DoH traces requires different features than those used to attack HTTPS or Tor traffic. We propose a new feature set tailored to the characteristics of DoH traffic. Our classifiers obtain an F1-score of 0.9 and 0.7 in closed and open world settings, respectively. We show that although factors such as location, resolver, platform, or client affect performance, they are far from completely deterring the attacks. We then study deployed countermeasures and show that, in contrast with web traffic, Tor effectively protects users. Specified defenses, however, still preserve patterns and leave some webs unprotected. Finally, we show that web censorship is still possible by analysing DoH traffic and discuss how to selectively block content with low collateral damage.

Development of an algorithm to protect user communication devices against data leaks

“…Many scientists have been involved in the development of methods for analyzing DNS traffic, issues of its encryption in order to protect users' DNS requests from monitoring and censorship. For example, the authors of paper [13] have concluded that the existing standard DNS traffic schemes are ineffective. Works [14][15][16][17] emphasize the relevance of DNS traffic protection and point to the need for a thorough analysis of possible leaks.…”

Knocking on IPs: Identifying HTTPS Websites for Zero-Rated Traffic

“…e measurements are produced from a set of 1 M websites, which means that if one wants to maintain the desired accuracy, they should regularly restart the crawling process to update the resulting set of IP addresses. Furthermore, Siby et al [36] have proposed an n-gram model to predict the domain names from DoH based on the sizes and timing of the packets. ey achieve an F1-score of 70% in an open world scenario of 1500 monitored webpages and demonstrate the robustness against countermeasures such as padding.…”

“…For instance, we could cache domain names from older look-ups or use optional precrawled domain names such as in [35]. Additionally, combinations with the DoH fingerprinting work of [36] may have a beneficial outcome on the accuracy of Open-Knock. Finally, a higher number of webpage samples (h) in Section 4.6 or a longer delay q in Section 4.5 may substantially increase the accuracy of our method, although future experiments would be useful to measure the exact impact.…”

Survey And Evaluation of Secure-DNS Alternatives Through Passive Measurements

“…EDNS(0) padding thus provides privacy for the encrypted DNS messages. However, Siby et al [93] found that adding EDNS(0) padding solely will not prevent traffic analysis attacks, and adversaries would still be able to access DNS content using ML-based analysis techniques.…”

“…DoT suggests using the EDNS(0) padding option to pad the DNS messages with a variable number of octets and make them more resilient against traffic-analysis and side-channel leaks in Stage-1. However, recent literature shows that encryption and padding techniques in DoT are not strong enough to resist Machine Learning (ML) based traffic analysis attacks [93,48]. DoT uses a specific port (853) and its traffic is distinguishable, which makes its traffic susceptible to blocking, redirecting, or censorship [49,63].…”