Abstract
DNS cookies is a recently standardised proposal of the IETF meant to protect DNS against off-path cache poisoning attacks. In contrast to other defences for DNS, DNS cookies is a lightweight mechanism, is easy to deploy and does not introduce overhead on the DNS servers. In this work we demonstrate off-path attacks allowing to circumvent the DNS cookies mechanism and impersonate legitimate Internet sources, exposing the DNS servers to cache poisoning and amplification reflection DoS attacks. We implement and evaluate the attacks, and provide recommendations for countermeasures.
| Original language | English |
|---|---|
| Article number | 9347968 |
| Journal | Proceedings - IEEE Global Communications Conference, GLOBECOM |
| Volume | 2020-January |
| DOIs | |
| State | Published - Dec 2020 |
| Externally published | Yes |
| Event | 2020 IEEE Global Communications Conference, GLOBECOM 2020 - Virtual, Taipei, Taiwan, Province of China Duration: 7 Dec 2020 → 11 Dec 2020 |
Bibliographical note
Publisher Copyright:© 2020 IEEE.
Funding
ACKNOWLEDGEMENTS This research work has been funded by the German Federal Ministry of Education and Research and the Hessen State Ministry for Higher Education, Research and Arts within their joint support of the National Research Center for Applied Cybersecurity ATHENE and by the DFG as part of project S3 within the CRC 1119 CROSSING.
| Funders | Funder number |
|---|---|
| National Research Center for Applied Cybersecurity | |
| Deutsche Forschungsgemeinschaft | |
| Bundesministerium für Bildung und Forschung | |
| Hessisches Ministerium für Wissenschaft und Kunst |