Nothing Special   »   [go: up one dir, main page]
Skip to main content
Springer Nature Link
Log in

Intercept and Inject: DNS Response Manipulation in the Wild

  • Conference paper
  • First Online:
Passive and Active Measurement (PAM 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 13882))

Included in the following conference series:

Abstract

DNS is a protocol responsible for translating human-readable domain names into IP addresses. Despite being essential for many Internet services to work properly, it is inherently vulnerable to manipulation. In November 2021, users from Mexico received bogus DNS responses when resolving whatsapp.net. It appeared that a BGP route leak diverged DNS queries to the local instance of the k-root located in China. Those queries, in turn, encountered middleboxes that injected fake DNS responses. In this paper, we analyze that event from the RIPE Atlas point of view and observe that its impact was more significant than initially thought—the Chinese root server instance was reachable from at least 15 countries several months before being reported. We then launch a nine-month longitudinal measurement campaign using RIPE Atlas probes and locate 11 probes outside China reaching the same instance, although this time over IPv6. More broadly, motivated by the November 2021 event, we study the extent of DNS response injection when contacting root servers. While only less than 1% of queries are impacted, they originate from 7% of RIPE Atlas probes in 66 countries. We conclude by discussing several countermeasures that limit the probability of DNS manipulation.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
$34.99 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 64.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 84.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

References

  1. Root Server Technical Operations Association (2022). https://root-servers.org

  2. Anderson, C., Winter, P., Ensafi, R.: Global censorship detection over the RIPE Atlas network. In: USENIX FOCI (2014)

    Google Scholar 

  3. Anonymous: The Collateral Damage of Internet Censorship by DNS Injection. SIGCOMM Comput. Commun. Rev. 42(3), June 2012

    Google Scholar 

  4. Anonymous: Towards a Comprehensive Picture of the Great Firewall’s DNS Censorship. In: USENIX FOCI (2014)

    Google Scholar 

  5. Anonymous, Niaki, A.A., Hoang, N.P., Gill, P., Houmansadr, A.: Triplet censors: demystifying great firewall’s DNS censorship behavior. In: USENIX FOCI (2020)

    Google Scholar 

  6. APNIC: Encrypted DNS World Map, January 2023. https://stats.labs.apnic.net/edns

  7. Filastò, A., Appelbaum, J.: OONI: open observatory of network interference. In: USENIX FOCI (2012)

    Google Scholar 

  8. Austein, R.: DNS Name Server Identifier (NSID) Option. RFC 5001 (2007)

    Google Scholar 

  9. Bailey, M., Kenneally, E., Maughan, D., Dittrich, D.: The menlo report. IEEE Secur. Privacy 10(02), 71–75 (2012)

    Google Scholar 

  10. Bayer, J., Nosyk, Y., Hureau, O., Fernandez, S., Paulovics, I., Duda, A., Korczyński, M.: Study on Domain Name System (DNS) abuse : technical report. Appendix 1. Publications Office of the European Union (2022). https://doi.org/10.2759/473317

  11. Bhaskar, A., Pearce, P.: Many roads lead to Rome: how packet headers influence DNS censorship measurement. In: USENIX Security (2022)

    Google Scholar 

  12. Bock, K., Alaraj, A., Fax, Y., Hurley, K., Wustrow, E., Levin, D.: Weaponizing middleboxes for TCP reflected amplification. In: USENIX Security (2021)

    Google Scholar 

  13. Bortzmeyer, S.: DNS Censorship (DNS Lies) As Seen By RIPE Atlas, December 2015. https://labs.ripe.net/author/stephane_bortzmeyer/dns-censorship-dns-lies-as-seen-by-ripe-atlas/

  14. Bortzmeyer, S., Dolmans, R., Hoffman, P.E.: DNS query name minimisation to improve privacy. RFC 9156 (2021)

    Google Scholar 

  15. Bretelle, M.: [dns-operations] K-root in CN leaking outside of CN, November 2021. https://lists.dns-oarc.net/pipermail/dns-operations/2021-November/021437.html

  16. Chung, T., Choffnes, D., Mislove, A.: Tunneling for transparency: a large-scale analysis of end-to-end violations in the internet. In: IMC (2016)

    Google Scholar 

  17. Chung, T., van Rijswijk-Deij, R., Chandrasekaran, B., Choffnes, D., Levin, D., Maggs, B.M., Mislove, A., Wilson, C.: A Longitudinal. USENIX Security, End-to-End View of the DNSSEC Ecosystem. In (2017)

    Google Scholar 

  18. Conrad, D.R., Woolf, S.: Requirements for a Mechanism Identifying a Name Server Instance. RFC 4892 (2007)

    Google Scholar 

  19. Dagon, D., Lee, C., Lee, W., Provos, N.: Corrupted DNS resolution paths: the rise of a malicious resolution authority. In: NDSS (2008)

    Google Scholar 

  20. DNSFilter: DNS Threat Protection (2022). https://www.dnsfilter.com

  21. Fan, X., Heidemann, J., Govindan, R.: Evaluating anycast in the domain name system. In: IEEE INFOCOM (2013)

    Google Scholar 

  22. Farnan, O., Darer, A., Wright, J.: Poisoning the well: exploring the great firewall’s poisoned DNS responses. In: WPES (2016)

    Google Scholar 

  23. Gill, P., Crete-Nishihata, M., Dalek, J., Goldberg, S., Senft, A., Wiseman, G.: Characterizing Web censorship worldwide: another look at the OpenNet initiative data. ACM Trans. Web 9(1), 1–29 (2015)

    Google Scholar 

  24. Gillmor, D.K., Salazar, J., Hoffman, P.E.: Unilateral Opportunistic Deployment of Encrypted Recursive-to-Authoritative DNS. Internet-Draft draft-ietf-dprive-unilateral-probing-02, Internet Engineering Task Force, September 2022. work in Progress

    Google Scholar 

  25. Google: SafeSearch (2022). https://safety.google/products/#search

  26. Hilton, A., Deccio, C., Davis, J.: Fourteen years in the life: a root server’s perspective on DNS resolver security. In: USENIX Security (2023)

    Google Scholar 

  27. Hoang, N.P., Doreen, S., Polychronakis, M.: Measuring I2P censorship at a global scale. In: USENIX FOCI (2019)

    Google Scholar 

  28. Hoang, N.P., Niaki, A.A., Dalek, J., Knockel, J., Lin, P., Marczak, B., Crete-Nishihata, M., Gill, P., Polychronakis, M.: How Great is the Great Firewall? USENIX Security, Measuring China’s DNS Censorship. In (2021)

    Google Scholar 

  29. Hoffman, P.E., McManus, P.: DNS Queries over HTTPS (DoH). RFC 8484 (2018)

    Google Scholar 

  30. Hu, Z., Zhu, L., Heidemann, J., Mankin, A., Wessels, D., Hoffman, P.E.: Specification for DNS over Transport Layer Security (TLS). RFC 7858 (2016)

    Google Scholar 

  31. Huitema, C., Dickinson, S., Mankin, A.: DNS over Dedicated QUIC Connections. RFC 9250 (2022)

    Google Scholar 

  32. Jones, B., Feamster, N., Paxson, V., Weaver, N., Allman, M.: Detecting DNS root manipulation. In: PAM (2016)

    Google Scholar 

  33. Kührer, M., Hupperich, T., Rossow, C., Holz, T.: Exit from hell? reducing theimpact of amplification DDoS attacks. In: USENIX Security (2014)

    Google Scholar 

  34. Kumari, W.A., Hoffman, P.E.: Running a Root Server Local to a Resolver. RFC 8806 (2020)

    Google Scholar 

  35. Li, C., Cheng, Y., Men, H., Zhang, Z., Li, N.: Performance analysis of root anycast nodes based on active measurement. Electronics 11(8), 1194 (2022)

    Article  Google Scholar 

  36. Li, Z., Levin, D., Spring, N., Bhattacharjee, B.: Internet Anycast: Performance, Problems, & Potential. SIGCOMM (2018)

    Google Scholar 

  37. Lindqvist, K.E., Abley, J.: Operation of Anycast Services. RFC 4786 (2006)

    Google Scholar 

  38. Liu, B., Lu, C., Duan, H., Liu, Y., Li, Z., Hao, S., Yang, M.: Who is answering my queries: understanding and characterizing interception of the DNS resolution path. In: USENIX Security (2018)

    Google Scholar 

  39. Lowe, G., Winters, P., Marcus, M.L.: The Great DNS Wall of China. New York University, Technical report (2007)

    Google Scholar 

  40. Lu, C., et al.: An end-to-end, large-scale measurement of DNS-over-encryption: how far have we come? In: IMC (2019)

    Google Scholar 

  41. Mockapetris, P.: Domain names - concepts and facilities. RFC 1034 (1987)

    Google Scholar 

  42. Mockapetris, P.: Domain names - implementation and specification. RFC 1035 (1987)

    Google Scholar 

  43. Moura, G.C.M., et al.: Old but gold: prospecting TCP to engineer and live monitor DNS anycast. In: PAM (2022)

    Google Scholar 

  44. Moura, G.C.M., et al.: Anycast vs. DDoS: evaluating the November 2015 root DNS event. In: IMC (2016)

    Google Scholar 

  45. Nawrocki, M., Koch, M., Schmidt, T.C., Wählisch, M.: Transparent forwarders: an unnoticed component of the open DNS infrastructure. In: CoNEXT (2021)

    Google Scholar 

  46. Niaki, A.A., et al.: ICLab: a global, longitudinal internet censorship measurement platform. In: IEEE S &P (2020)

    Google Scholar 

  47. Pearce, P., Ensafi, R., Li, F., Feamster, N., Paxson, V.: Towards continual measurement of global network-level censorship. In: IEEE S &P (2018)

    Google Scholar 

  48. Pearce, P., et al.: Global measurement of DNS manipulation. In: USENIX Security (2017)

    Google Scholar 

  49. Le Pochat, V., Van Goethem, T., Tajalizadehkhoob, S., Korczyński, M., Joosen, W.: Tranco: a research-oriented top sites ranking hardened against manipulation. In: NDSS (2019)

    Google Scholar 

  50. Raman, R.S., Stoll, A., Dalek, J., Ramesh, R., Scott, W., Ensafi, R.: Measuring the deployment of network censorship filters at global scale. In: NDSS (2020)

    Google Scholar 

  51. Randall, A., et al.: Home is where the hijacking is: understanding DNS interception by residential routers. In: IMC (2021)

    Google Scholar 

  52. RIPE Atlas: Legal (2020). https://atlas.ripe.net/legal/terms-conditions/

  53. RIPE Atlas: Built-in Measurements (2022). https://atlas.ripe.net/docs/built-in-measurements/

  54. RIPE Ncc: RIPE Atlas (2022). https://atlas.ripe.net

  55. Rose, S., Larson, M., Massey, D., Austein, R., Arends, R.: DNS Security Introduction and Requirements. RFC 4033 (2005)

    Google Scholar 

  56. Snabb, J.: F.ROOT-SERVERS.NET moved to Beijing? https://seclists.org/nanog/2011/Oct/12, October 2011

  57. Sundara Raman, R., Shenoy, P., Kohls, K., Ensafi, R.: Censored planet: aninternet-wide, longitudinal censorship observatory. In: CCS (2020)

    Google Scholar 

  58. VanderSloot, B., McDonald, A., Scott, W., Halderman, J.A., Ensafi, R.: Quack: scalable remote measurement of application-layer censorship. In: USENIX Security (2018)

    Google Scholar 

  59. Vergara Ereche, M.: [dns-operations] Odd behaviour on one node in I root-server (facebook, youtube & twitter), March 2010. https://lists.dns-oarc.net/pipermail/dns-operations/2010-March/005263.html

  60. Weaver, N., Kreibich, C., Nechaev, B., Paxson, V.: Implications of Netalyzrs DNS Measurements. In: SATIN (2011)

    Google Scholar 

  61. Weaver, N., Kreibich, C., Paxson, V.: Redirecting DNS for Ads and Profit. In: USENIX FOCI (2011)

    Google Scholar 

Download references

Acknowledgments

We thank root server operators for validating the nameserver identifiers. This work was partially supported by RIPE NCC, Carnot LSI, the Grenoble Alpes Cybersecurity Institute (under the contract ANR-15-IDEX-02), and the French Ministry of Research (PERSYVAL-Lab project under the contract ANR-11-LABX-0025-01 and DiNS project under the contract ANR-19-CE25-0009-01).

Author information

Authors and Affiliations

  1. Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG, Grenoble, France

    Yevheniya Nosyk, Andrzej Duda & Maciej Korczyński

  2. TU Delft, Delft, The Netherlands

    Yury Zhauniarovich, Carlos H. Gañán & Giovane C. M. Moura

  3. SIDN Labs, Arnhem, The Netherlands

    Giovane C. M. Moura

  4. RIPE NCC, Amsterdam, The Netherlands

    Qasim Lone & Emile Aben

  5. ICANN, Los Angeles, CA, USA

    Carlos H. Gañán & Samaneh Tajalizadehkhoob

Authors
  1. Yevheniya Nosyk
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Qasim Lone
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Yury Zhauniarovich
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Carlos H. Gañán
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Emile Aben
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Giovane C. M. Moura
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. Samaneh Tajalizadehkhoob
    View author publications

    You can also search for this author in PubMed Google Scholar

  8. Andrzej Duda
    View author publications

    You can also search for this author in PubMed Google Scholar

  9. Maciej Korczyński
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Yevheniya Nosyk .

Editor information

Editors and Affiliations

  1. Karlstad University, Karlstad, Sweden

    Anna Brunstrom

  2. Edgio, Scottsdale, AZ, USA

    Marcel Flores

  3. IMDEA Networks Institute, Madrid, Spain

    Marco Fiore

Appendix

Appendix

1.1 Generalized Linear Mixed-Effects Model

To determine which factors make DNS queries more susceptible to manipulation, we fit a generalized linear mixed-effects model (GLMM) assuming a binomial distribution with logit link function (logistic regression) while accounting for the country-level random effects, i.e., with the response variable as a logit transformation of DNS response state: 1 (manipulated) or 0 (not manipulated). With the inclusion of country effects, we account for observable and unobservable factors specific to queries executed within a country such as state-level filtering factors, which potentially influence DNS response manipulation. We describe the results in odds ratios, indicating the change in the odds of DNS queries getting manipulated. The modeling results are presented in Fig. 5 and discussed in detail in Sect. 3.6.

Fig. 5.
figure 5

Odds ratios of DNS injection survival. Values above 1 (in blue) indicate that the corresponding variables increase the chances of DNS injection, while ratios below 1 (in red) decrease the chances of DNS injection. The 95% confidence limits are delimited by horizontal lines. Those that do not cross the zero line correspond to variables that affect DNS injection more significantly. (Color figure online)

Full size image
Table 2. Services identified from 12,150 unique NSID strings.
Full size table
Fig. 6.
figure 6

The ratio (in %) of probes that experienced response injection to all the probes participating in our measurements. We did not receive any results for countries highlighted in grey. (Color figure online)

Full size image
Table 3. The ratio of RIPE Atlas probes experiencing manipulation to all those hosted in a particular country. This table only includes countries with at least one probe experiencing manipulation.
Full size table

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Nosyk, Y. et al. (2023). Intercept and Inject: DNS Response Manipulation in the Wild. In: Brunstrom, A., Flores, M., Fiore, M. (eds) Passive and Active Measurement. PAM 2023. Lecture Notes in Computer Science, vol 13882. Springer, Cham. https://doi.org/10.1007/978-3-031-28486-1_19

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-28486-1_19

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-28485-4

  • Online ISBN: 978-3-031-28486-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation