Publikationen

Autor	Heftrig, Elias; Schulmann, Haya; Waidner, Michael
Datum	2023
Art	Conference Proceedings
Abstrakt	Recent works found that signing zones with new cryptographic ciphers may disable DNSSEC validation in DNS resolvers. Adversaries could exploit this to manipulate algorithm numbers of ciphers in DNS responses, to make them appear as unknown, hence maliciously downgrading DNSSEC validation. In this work we show that these manipulation of DNSSEC records can also be launched remotely by off-path adversaries. We develop a DNSSEC downgrade attack using IP fragmentation. The idea is to create large DNS responses, that exceed the Maximum Transmission Unit on that path. The off-path adversary injects a malicious IP fragment, which when reassembled with the genuine IP fragment, overwrites the algorithm number of the ciphers in DNSSEC records.Our experimental evaluation of the off-path attack with a victim resolver that we set up identified 7.7K vulnerable domains out of 43K DNSSEC-signed 1M-top Tranco domains. We provide recommendations to mitigate the vulnerabilities.
ISBN	9798400702365
In	Proceedings of the ACM SIGCOMM 2023 Conference, p.1120-1122
Publisher	Association for Computing Machinery
Schlüssel	heftrig2023offpath

Poster: Off-Path DNSSEC Downgrade Attacks