3 ms·

Weird to read an article on cache poisoning and not a single mention of DNSSEC. DNSSEC completely defeats DNS cache poisoning. If you worry about DNS cache poi

Weird to read an article on cache poisoning and not a single mention of DNSSEC. DNSSEC completely defeats DNS cache poisoning. If you worry about DNS cache poisoning, sign your domains and validate the responses you get.

LinuxBender 6y ago
Does that mitigate this scenario? In many cases, clients may be talking directly to 1.1.1.1, not servers. At least that is a pattern I have seen people using. Only servers validate DNSSEC. So people using Unbound DNS at home or in their corporate network may be protected from this, but I am not aware of any local OS resolvers that validate DNSSEC. You are right though, people should certainly be using DNSSEC on all their zones.
- alwillis 6y ago
  You can use Unbound as your local resolver pretty easily. I run it on an old laptop running FreeBSD and have my other machines use it as their DNS server.
  - LinuxBender 6y ago
    Absolutely. I do this as well on a couple laptops so I get the same anti-adware my home network has. I've even managed to get a couple other people to try it out.
  - tptacek 6y ago
    That solves that one DNSSEC problem for you, but no mainstream operating system deploys a local DNSSEC-validating recursive cache, and something like half of all Internet usage comes from mobile/tablet devices where you can't do that at all. Realistically, to a first approximation, nobody is going to do this.
tptacek 6y ago
Probably because DNSSEC is moribund, virtually none of the most popular zones on the Internet are signed despite a decade of deployment effort, the protocol itself doesn't protect end-system lookups (it's a server-to-server protocol), and DNS-over-HTTPS has for the most part eliminated any impetus to deploy it further.
btilly 6y ago
DNSSEC has its own problems, which is why it has not been widely adopted. See https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/ for more.
- alwillis 6y ago
  DNSSEC is mentioned in the FAQ [1]. Short answer: if DNSSEC is implemented strictly, it seemingly gets you most of the way there. Not clear if a configuration change or update to the protocol could completely mitigate the attack. BTW, there are nearly 13 million DNSSEC signed zones; the trend is certainly up [2]. Does DNSSEC mitigate the attack? Yes and no, the server must implement strict DNSSEC check (i.e., refuse the responses that break the trust chain) to prevent the off-path attacks. However, since DNSSEC is still under development and servers need to accept such responses (i.e., only DNSSEC aware but not DNSSEC validate) when visiting a misconfigured domain. [1]: https://www.cs.ucr.edu/~zhiyunq/SADDNS.html https://www.cs.ucr.edu/~zhiyunq/SADDNS.html [2]: https://stats.dnssec-tools.org https://stats.dnssec-tools.org
  - tptacek 6y ago
    The trend is in fact not up in North America; the last time I checked, it was slightly down. The paper we're commenting on also has some grim stats in it. Nobody is debating whether DNSSEC addresses this attack --- it does, for server-to-server connections. But DNSSEC is an extremely expensive way to stop this attack, and because there are cheaper ways that don't require collaboration between unrelated parties on the Internet, those are the mitigations --- ICMP policy changes, 0x20 encoding, DNS cookies, etc --- that will happen.
    - arminiusreturns 6y ago
      I haven't been keeping up, do you know if DNSCURVE also prevents this attack? I remember digging into it a bit a while back (~2015) and coming away thinking I liked DNSCURVE a lot better, but that in the end I expected both to be used in conjuction in the future.

LinuxBender 6y ago

Does that mitigate this scenario? In many cases, clients may be talking directly to 1.1.1.1, not servers. At least that is a pattern I have seen people using. Only servers validate DNSSEC. So people using Unbound DNS at home or in their corporate network may be protected from this, but I am not aware of any local OS resolvers that validate DNSSEC. You are right though, people should certainly be using DNSSEC on all their zones.

alwillis 6y ago
You can use Unbound as your local resolver pretty easily. I run it on an old laptop running FreeBSD and have my other machines use it as their DNS server.
- LinuxBender 6y ago
  Absolutely. I do this as well on a couple laptops so I get the same anti-adware my home network has. I've even managed to get a couple other people to try it out.
- tptacek 6y ago
  That solves that one DNSSEC problem for you, but no mainstream operating system deploys a local DNSSEC-validating recursive cache, and something like half of all Internet usage comes from mobile/tablet devices where you can't do that at all. Realistically, to a first approximation, nobody is going to do this.

tptacek 6y ago

Probably because DNSSEC is moribund, virtually none of the most popular zones on the Internet are signed despite a decade of deployment effort, the protocol itself doesn't protect end-system lookups (it's a server-to-server protocol), and DNS-over-HTTPS has for the most part eliminated any impetus to deploy it further.

btilly 6y ago

DNSSEC has its own problems, which is why it has not been widely adopted. See https://sockpuppet.org/blog/2015/01/15/against-dnssec/ https://sockpuppet.org/blog/2015/01/15/against-dnssec/ for more.

alwillis 6y ago
DNSSEC is mentioned in the FAQ [1]. Short answer: if DNSSEC is implemented strictly, it seemingly gets you most of the way there. Not clear if a configuration change or update to the protocol could completely mitigate the attack. BTW, there are nearly 13 million DNSSEC signed zones; the trend is certainly up [2]. Does DNSSEC mitigate the attack? Yes and no, the server must implement strict DNSSEC check (i.e., refuse the responses that break the trust chain) to prevent the off-path attacks. However, since DNSSEC is still under development and servers need to accept such responses (i.e., only DNSSEC aware but not DNSSEC validate) when visiting a misconfigured domain. [1]: https://www.cs.ucr.edu/~zhiyunq/SADDNS.html https://www.cs.ucr.edu/~zhiyunq/SADDNS.html [2]: https://stats.dnssec-tools.org https://stats.dnssec-tools.org
- tptacek 6y ago
  The trend is in fact not up in North America; the last time I checked, it was slightly down. The paper we're commenting on also has some grim stats in it. Nobody is debating whether DNSSEC addresses this attack --- it does, for server-to-server connections. But DNSSEC is an extremely expensive way to stop this attack, and because there are cheaper ways that don't require collaboration between unrelated parties on the Internet, those are the mitigations --- ICMP policy changes, 0x20 encoding, DNS cookies, etc --- that will happen.
  - arminiusreturns 6y ago
    I haven't been keeping up, do you know if DNSCURVE also prevents this attack? I remember digging into it a bit a while back (~2015) and coming away thinking I liked DNSCURVE a lot better, but that in the end I expected both to be used in conjuction in the future.