Formal Analysis of the Kaminsky DNS Cache-Poisoning Attack Using Probabilistic Model Checking

Abstract

Abstract-We use the probabilistic model checker PRISM to formally model and analyze the highly publicized Kaminsky DNS cache-poisoning attack. DNS (Domain Name System) is an internet-wide, hierarchical naming system used to translate domain names such as google.com into physical IP addresses such as 208.77.188.166. The Kaminsky DNS attack is a recently discovered vulnerability in DNS that allows an intruder to hijack a domain; i.e. corrupt a DNS server so that it replies with the IP address of a malicious web server when asked to resolve URLs within a non-malicious domain such as google.com. A proposed fix for the attack is based on the idea of randomizing the source port a DNS server uses when issuing a query to another server in the DNS hierarchy.We use PRISM to introduce a Continuous Time Markov Chain representation of the Kaminsky attack and the proposed fix, and to perform the required probabilistic model checking. Our results, gleaned from more than 240 PRISM runs, formally validate the existence of the Kaminsky cache-poisoning attack even in the presence of an intruder with virtually no knowledge of the victim DNS server's actions. They also serve to quantify the effectiveness of the proposed fix: using nonlinear least-squares curve fitting, we show that the probability of a successful attack obeys a 1/N distribution, where N is the upper limit on the range of source-port ids. We also demonstrate an increasing attack probability with an increasing number of attempted attacks or increasing rate at which the intruder guesses the source-port id.

Analysis and Modeling of False Synchronizations in 3G-WLAN Integrated Networks

“…Finally, we solved the linear system of equations to derive the probability of a false synchronization. As a future work, we could apply probabilistic model checking to verify the correctness of the analytical model and improve the modeling effectiveness [9].…”

Model Repair for Probabilistic Systems

“…Our CTMC model for the Kaminsky attack [1] implements a victim DNS server that generates times to request url queries to resolve one or more resource names within some domain. While the victim waits for a legitimate response to its query, the intruder tries with rate guess to provide a fake response that, if correctly matching the query id, will be accepted by the victim, thus corrupting its cache.…”

“…-We also provide a control-theoretic characterization of the probabilistic Model Repair problem, and in the process establish a formal link between model repair and the controller-synthesis problem for linear systems. -We demonstrate the practical utility of our approach by applying it to a number of significant case studies, including a DTMC reward model of the Zeroconf protocol for assigning IP addresses, and a CTMC model of the highly publicized Kaminsky DNS cache-poisoning attack [1]. The rest of the paper develops along the following lines.…”

A Proxy View of Quality of Domain Name Service, Poisoning Attacks and Survival Strategies

“…Wong and Nikander [2010] proposed a new architecture to secure DNS, basing the architecture on the idea of decoupling identity and location; using certificate look-up to establish authority, and a dns-like service to discover location. Dagon's presentation [Dagon 2008] and Alexiou et al's [2010] analytical work discussed the danger in DNS cache poisoning, with Dagon [2008] referring to some recent RFCs to combat the attack, and Alexiou et al [2010] studied the Kaminsky attack in depth. Suggestion in all works require implementation change at the server side, in which the client is dependent on the adoption rate of the implementation change.…”