Hello everyone, welcome to our presentation. I am
Tianxiang Dai, I am here to present our
work DNS over TCP considered vulnerable. This is
a work together with Dr. Haya Shuman and
Professor Michael Weissner. We are all from
German National Research Center for Applied
Cybersecurity Athena in Darmstadt, Germany. In
this presentation, we will first briefly
introduce our motivation about this work and
afterwards we show our evaluation in the internet.
Based on the evaluation results, we present a
potential exploit. Afterwards, we propose
some court measures and then conclude our work.
Our motivation is based on our previous work on
DNS over UDP. So we all know that DNS over
UDP is vulnerable to IP fragmentation attacks. So
then another question is that what about
DNS over TCP? Is it also vulnerable to IP fragmentation
attacks or not? So we searched
some related works to find out that it is well
believed that IP fragmentation attacks
doesn't work with TCP. For example, there is a
draft best common practice, IP fragmentation
considered fragile. It says there is alternatives
to IP fragmentation which is using TCP with
PM2D. There is also another best common practice
in draft, fragmentation avoidance in DNS.
It says TCP is considered a resistance against IP
fragmentation attacks. Also, in last year's
DNS fragment day, which is the event among the
DNS operations community, it says TCP
normally implements PM2D and can avoid IP fragmentation
of TCP segments. So it is real?
Does DNS over TCP really protect against IP fragmentation
attacks? To check this, we designed
our evaluation in the internet. So we want to
trigger fragmentation over TCP on name
servers in the internet and then compare with UDP.
We designed follow evaluation. So we
have our resolver and we find some name servers
in the internet. We first establish a TCP
connection to the name server and then send the
DNS query over the TCP connection. After
getting the response, we send ICMP packet to big
to indicating our MTU on the road is
too small and we wait for the DNS response retransmission.
As a comparison, we do similar
evaluation over UDP, but considering UDP is the
connectionless protocol, so it's a little
bit different. We first send the DNS request and
then get the response. Afterwards, we
send ICMP packet to big instead of waiting for
the retransmission since there's no UDP
doesn't do retransmission. So we send another DNS
request, the same as before, and wait
for the second DNS response and check if it's
fragmented or not. Then what's the result?
We tested against Alexa top 100,000 domains. In
the end, we get about 500 domains fragmented
over TCP. As a comparison, there are over 9,000
domains fragmented over UDP, but this
is not surprising. We all know UDP is vulnerable
to IP fragmentation attacks. When we dig into
more details about the fragmented domains over
TCP, we find out that the majority of
them are only vulnerable to TCP. There's about 20%
vulnerable to both and 80% vulnerable
only to TCP. When we check among those domains
only vulnerable to fragmentation over TCP,
we find out that there are even 76 domains which
have TCP bit set when we tested over
UDP. What does that mean? TCP bit means truncated.
It is set when the DNS payload is too big
for the UDP or when the server is very limited.
In any case, it means the name server has
a preference over TCP. So it's the name server
will try to use TCP instead of UDP. So that
means there are just these 76 domains, they try
to use TCP, which the name server thought
is better, but actually it's vulnerable to IP
fragmentation attacks, which make it worse.
So we also check, find out that TCP tends to get
smaller fragments than UDP. We find
out that there are about 40% domains which
fragments over TCP, they have fragments smaller
than 290. While over UDP, there are about over 90%
domains has fragments over 540. So
what does this mean? Smaller fragments means more
payloads are in the second fragment or
other fragments. So that means more payloads are
injectable. So this is resulting stronger
exploits, which makes things worse. Based on our
previous evaluation, we proposed a
potential exploit. So as we presented here, this
is the example of a fragmented DNS packet
over TCP. So the packet above is the first
fragment, the packet in the bottom is the
second fragment. So we can inject a malicious
payload into DNS via IP fragmentation over
TCP. So as we know, so the original DNS cache
poisoning is using flooding to bypass the
DNS challenge, which is the DNS transaction ID.
It's the 16 bit, it can be easily flooded.
So to secure it, we further introduce some
challenges in UDP. Also in UDP source port,
so here in TCP2. So the TCP challenge here at the
TCP source port. Here we show the packet
from the nameserver to the resolver, so it's the
destination port. And also the TCP sequence
number and acknowledgement number, both of them
are 32 bits, so it's believed to be really
hard to spoof. But as we can see, both of these
challenges, the TCP challenge and the
DNS challenge, they are in the first fragment. So
that means if we can trigger fragmentation,
we don't need to take care of them. They're in
the first fragment. We only need to spoof
the second fragment. But when we try to spoof the
second fragment, we only need to take
care of the IP challenge, which is the IP ID.
There are many works about making, there
are many works using, make use of IP IDs. I
wouldn't dig into details here, but we did
a quick check. We find out that there are even
2000 domains still using globally sequential
IP IDs for TCP. That means they use the global
counter for all the TCP connections. So that
means the attacker can just using a second
machine to probe the IP IDs and do a just
simple linear regression. And then he can easily
guess the IP ID, which makes the exploit
really workable. So what are the countermeasures?
We propose the countermeasures in different
layers. For example, for IP, the easy dirty way
is just to filter the fragments or just
filter the small fragments like Google do. Google
filter all the small fragments smaller
than 500, so make it less vulnerable. But
sometimes to filter the fragment will make
the network down or doesn't work well. So another
way is just to randomize the IP IDs
to make it hard to spoof. But still, sometimes it's
still vulnerable to some side channel
attacks like before. Another way is to disable PMTOD
in TCP layer. So there are research
works find out that PMTOD is not really useful.
So we can just disable it and that's we can
just filter as they may pack it too big. Another
way to countermeasure these attacks is to
just to enable DNSSEC because DNSSEC is like
final solution to all DNS cache poison attacks.
But we just need to make sure that DNSSEC is
configured properly. There are a few other
works about DNS misconfigurations which make it
even vulnerable when DNSSEC is enabled.
So make sure. Then our conclusions. We find out
that DNS over TCP is still vulnerable
to IP fragmentation attacks and we also doubt
that if it's really good to recommend using
TCP to avoid fragmentation. That's it. Thank you
so much.
[End of Audio]
Duration 10 minutes
1