Home is where the hijacking is

Randall, Audrey; Liu, Enze; Padmanabhan, Ramakrishna; Akiwate, Gautam; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron

doi:10.1145/3487552.3487817

Cited by 5 publications

(2 citation statements)

References 32 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…More intrusive DNS interceptors, such as national censors, impersonate intended query destinations and actively inject bogus responses [38]. DNS interception is often accomplished at Customer Premises Equipment [51] and can be detected by issuing CHAOS-class or other DNS queries with the NSID option enabled.…”

Section: Identifying Injectorsmentioning

confidence: 99%

“…More broadly, various types of DNS manipulation have been extensively studied in the literature. Censors [57,50,58,47,48,7,23,27,46], transparent forwarders [45,33], rogue DNS servers [19], and middleboxes [51,38,61,60,16]-all interfere with the normal DNS resolution process. Particular attention has been paid to the GFW of China [3,4,5,11,22,28,39], known to intercept DNS traffic and inject bogus responses.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Intercept and Inject: DNS Response Manipulation in the Wild

Nosyk

Lone²,

Zhauniarovich

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

DNS is a protocol responsible for translating human-readable domain names into IP addresses. Despite being essential for many Internet services to work properly, it is inherently vulnerable to manipulation. In November 2021, users from Mexico received bogus DNS responses when resolving whatsapp.net. It appeared that a BGP route leak diverged DNS queries to the local instance of the k-root located in China. Those queries, in turn, encountered middleboxes that injected fake DNS responses. In this paper, we analyze that event from the RIPE Atlas point of view and observe that its impact was more significant than initially thought-the Chinese root server instance was reachable from at least 15 countries several months before being reported. We then launch a ninemonth longitudinal measurement campaign using RIPE Atlas probes and locate 11 probes outside China reaching the same instance, although this time over IPv6. More broadly, motivated by the November 2021 event, we study the extent of DNS response injection when contacting root servers. While only less than 1% of queries are impacted, they originate from 7% of RIPE Atlas probes in 66 countries. We conclude by discussing several countermeasures that limit the probability of DNS manipulation.

show abstract

Section: Identifying Injectorsmentioning

confidence: 99%