Trufflehunter

Randall, Audrey; Liu, Enze; Akiwate, Gautam; Padmanabhan, Ramakrishna; Voelker, Geoffrey M.; Savage, Stefan; Schulman, Aaron

doi:10.1145/3419394.3423640

Cited by 22 publications

(8 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Specifically, in the without-cache experiment, we only perform a single query for each domain in our domain dataset towards the target DNS resolvers. Conversely, in the with-cache experiment, we query each domain twice within a 5-second interval, confirming cache hits through the maximum TTL value [121] and bypassing potential loadbalancing policies [94].…”

Section: Querying Performance Of Pdnsmentioning

confidence: 98%

Understanding the Implementation and Security Implications of Protective DNS Services

Liu,

Zhang,

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Domain names are often registered and abused for harmful and illegal Internet activities. To mitigate such threats, as an emerging security service, Protective DNS (PDNS) blocks access to harmful content by proactively offering rewritten DNS responses, which resolve malicious domains to controlled hosts.While it has become an effective tool against cybercrime, given their implementation divergence, little has been done from the security community in understanding the deployment, operational status and security policies of PDNS services.

show abstract

Section: Querying Performance Of Pdnsmentioning

confidence: 98%

Understanding the Implementation and Security Implications of Protective DNS Services

Liu,

Zhang,

et al. 2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…We infer the presence of cache for this group of resolvers. Note that this is a lower bound estimation for caching open resolvers due to the existence of complex caching implementations (e.g., in case of public DNS resolvers) [33]. Key Takeaway: The fact that majority of open resolvers do not respond from cache provides an opportunity to deploy response rate limiting on authoritative nameservers or upstream resolvers as a measure to dampen the impact of amplification attacks.…”

Section: Cachingmentioning

confidence: 99%

A Matter of Degree: Characterizing the Amplification Power of Open DNS Resolvers

Yazdani

Rijswijk-Deij

Jonker

et al. 2022

Passive and Active Measurement

View full text Add to dashboard Cite

Open DNS resolvers are widely misused to bring about reflection and amplification DDoS attacks. Indiscriminate efforts to address the issue and take down all resolvers have not fully resolved the problem, and millions of open resolvers still remain available to date, providing attackers with enough options. This brings forward the question if we should not instead focus on eradicating the most problematic resolvers, rather than all open resolvers indiscriminately. Contrary to existing studies, which focus on quantifying the existence of open resolvers, this paper focuses on infrastructure diversity and aims at characterizing open resolvers in terms of their ability to bring about varying attack strengths. Such a characterization brings nuances to the problem of open resolvers and their role in amplification attacks, as it allows for more problematic resolvers to be identified. Our findings show that the population of open resolvers lies above 2.6M range over our one-year measurement period. On the positive side, we observe that the majority of identified open resolvers cut out when dealing with bulky and DNSSEC-related queries, thereby limiting their potential as amplifiers. We show, for example, that 59% of open resolvers lack DNSSEC support. On the downside, we see that a non-negligible number of open resolvers facilitate large responses to ANY and TXT queries (8.1% and 3.4% on average, respectively), which stands to benefit attackers. Finally we show that by removing around 20% of potent resolvers the global DNS amplification potential can be reduced by up to 80%.

show abstract

“…(3) The number of independent caches in recursive resolver services [44,53]. (4) If recursive resolvers cache negative replies.…”

Section: The Tsuname Problemmentioning

confidence: 99%

“…While cycles were recognized as a problem more than 30 years ago, the problem is pressing today because evolution of the system has amplified query rates: the "happy eyeballs" algorithm doubles queries [62] and large public resolvers often use parallelism across many machines without shared caches [44]. Recommendations from 1987 and 1993 emphasize the role of the single recursive resolver without considering the interactions in today's DNS ecosystem.…”

Section: The Tsuname Problemmentioning

confidence: 99%

“…On the left y axis, we show the interval inter-quartile range (IQR) of the time between queries (with the white line showing the median value in ms). Given that the TTL value of these records is 86400 s (1 day), we should not see (assuming low packet loss) any resolver sending more than one query on this date (except for multi-cache or anycast-based resolvers [34,44]). (While both domains in Figure 3 show some recursive resolvers query frequently, we expect the recursives see different offered load from clients, and we sort them differently, so the curves differ in detail.)…”

Section: Scrutinizing Google Queriesmentioning

confidence: 99%

See 1 more Smart Citation

TsuNAME

Moura

Castro²,

Heidemann

et al. 2021

Proceedings of the 21st ACM Internet Measurement Conference

View full text Add to dashboard Cite

TheInternet's Domain Name System (DNS) is a part of every web request and e-mail exchange, so DNS failures can be catastrophic, taking out major websites and services. This paper identifies TsuNAME, a vulnerability where some recursive resolvers can greatly amplify queries, potentially resulting in a denial-of-service to DNS services. TsuNAME is caused by cyclical dependencies in DNS records. A recursive resolver repeatedly follows these cycles, coupled with insufficient caching and application-level retries greatly amplify an initial query, stressing authoritative servers. Although issues with cyclic dependencies are not new, the scale of amplification has not previously been understood. We document real-world events in .nz (a country-level domain), where two misconfigured domains resulted in a 50% increase on overall traffic. We reproduce and document root causes of this event through experiments, and demostrate a 500× amplification factor. In response to our disclosure, several DNS software vendors have documented their mitigations, including Google public DNS and Cisco OpenDNS. For operators of authoritative DNS services we have developed and released CycleHunter, an open-source tool that detects cyclic dependencies and prevents attacks. We use CycleHunter to evaluate roughly 184 million domain names in 7 large, top-level domains (TLDs), finding 44 cyclic dependent NS records used by 1.4k domain names. The TsuNAME vulnerability is weaponizable, since an adversary can easily create cycles to attack the infrastructure of a parent domains. Documenting this threat and its solutions is an important step to ensuring it is fully addressed.

show abstract

Trufflehunter

Cited by 22 publications

References 30 publications

Understanding the Implementation and Security Implications of Protective DNS Services

Understanding the Implementation and Security Implications of Protective DNS Services

A Matter of Degree: Characterizing the Amplification Power of Open DNS Resolvers

TsuNAME

Contact Info

Product

Resources

About