Socket overloading for fun and cache-poisoning

Amir Herzberg; Haya Shulman

doi:10.1145/2523649.2523662

Socket overloading for fun and cache-poisoning

Amir Herzberg, Haya Shulman

Department of Computer Science

Technische Universität Darmstadt

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

32 Scopus citations

Abstract

We present a new technique, which we call socket overloading, that we apply for off-path attacks on DNS. Socket overloading consists of short, low-rate, bursts of inbound packets, sent by off-path attacker to a victim host. Socket overloading exploits the priority assigned by the kernel to hardware interrupts, and enables an off-path attacker to illicit a side-channel on client hosts, which can be applied to circumvent source port and name server randomisation. Both port and name server randomisation are popular and standardised defenses, recommended in [RFC5452], against attacks by off-path adversaries. We show how to apply socket overloading for DNS cache poisoning and name server pinning against popular systems that support algorithms recommended in [RFC6056] and [RFC4097] respectively. Our socket overloading technique may be of independent interest, and can be applied against other protocols for different attacks.

Original language	English
Title of host publication	Proceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013
Pages	189-198
Number of pages	10
DOIs	https://doi.org/10.1145/2523649.2523662
State	Published - 2013
Event	29th Annual Computer Security Applications Conference, ACSAC 2013 - New Orleans, LA, United States Duration: 9 Dec 2013 → 13 Dec 2013

Publication series

Name	ACM International Conference Proceeding Series

Conference

Conference	29th Annual Computer Security Applications Conference, ACSAC 2013
Country/Territory	United States
City	New Orleans, LA
Period	9/12/13 → 13/12/13

Keywords

Challenge-response mechanisms
DNS cache-poisoning
DNS security
I/O performance
IP derandomisation
Interrupts
Name server pinning
Off-path attacks
Port derandomization
Socket overloading

Access to Document

10.1145/2523649.2523662

Cite this

@inproceedings{8dc1ceb508f246d08e179fdcc949068b,

title = "Socket overloading for fun and cache-poisoning",

abstract = "We present a new technique, which we call socket overloading, that we apply for off-path attacks on DNS. Socket overloading consists of short, low-rate, bursts of inbound packets, sent by off-path attacker to a victim host. Socket overloading exploits the priority assigned by the kernel to hardware interrupts, and enables an off-path attacker to illicit a side-channel on client hosts, which can be applied to circumvent source port and name server randomisation. Both port and name server randomisation are popular and standardised defenses, recommended in [RFC5452], against attacks by off-path adversaries. We show how to apply socket overloading for DNS cache poisoning and name server pinning against popular systems that support algorithms recommended in [RFC6056] and [RFC4097] respectively. Our socket overloading technique may be of independent interest, and can be applied against other protocols for different attacks.",

keywords = "Challenge-response mechanisms, DNS cache-poisoning, DNS security, I/O performance, IP derandomisation, Interrupts, Name server pinning, Off-path attacks, Port derandomization, Socket overloading",

author = "Amir Herzberg and Haya Shulman",

year = "2013",

doi = "10.1145/2523649.2523662",

language = "אנגלית",

isbn = "9781450320153",

series = "ACM International Conference Proceeding Series",

pages = "189--198",

booktitle = "Proceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013",

note = "29th Annual Computer Security Applications Conference, ACSAC 2013 ; Conference date: 09-12-2013 Through 13-12-2013",

}

Herzberg, A & Shulman, H 2013, Socket overloading for fun and cache-poisoning. in Proceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013. ACM International Conference Proceeding Series, pp. 189-198, 29th Annual Computer Security Applications Conference, ACSAC 2013, New Orleans, LA, United States, 9/12/13. https://doi.org/10.1145/2523649.2523662

TY - GEN

T1 - Socket overloading for fun and cache-poisoning

AU - Herzberg, Amir

AU - Shulman, Haya

PY - 2013

Y1 - 2013

N2 - We present a new technique, which we call socket overloading, that we apply for off-path attacks on DNS. Socket overloading consists of short, low-rate, bursts of inbound packets, sent by off-path attacker to a victim host. Socket overloading exploits the priority assigned by the kernel to hardware interrupts, and enables an off-path attacker to illicit a side-channel on client hosts, which can be applied to circumvent source port and name server randomisation. Both port and name server randomisation are popular and standardised defenses, recommended in [RFC5452], against attacks by off-path adversaries. We show how to apply socket overloading for DNS cache poisoning and name server pinning against popular systems that support algorithms recommended in [RFC6056] and [RFC4097] respectively. Our socket overloading technique may be of independent interest, and can be applied against other protocols for different attacks.

AB - We present a new technique, which we call socket overloading, that we apply for off-path attacks on DNS. Socket overloading consists of short, low-rate, bursts of inbound packets, sent by off-path attacker to a victim host. Socket overloading exploits the priority assigned by the kernel to hardware interrupts, and enables an off-path attacker to illicit a side-channel on client hosts, which can be applied to circumvent source port and name server randomisation. Both port and name server randomisation are popular and standardised defenses, recommended in [RFC5452], against attacks by off-path adversaries. We show how to apply socket overloading for DNS cache poisoning and name server pinning against popular systems that support algorithms recommended in [RFC6056] and [RFC4097] respectively. Our socket overloading technique may be of independent interest, and can be applied against other protocols for different attacks.

KW - Challenge-response mechanisms

KW - DNS cache-poisoning

KW - DNS security

KW - I/O performance

KW - IP derandomisation

KW - Interrupts

KW - Name server pinning

KW - Off-path attacks

KW - Port derandomization

KW - Socket overloading

UR - http://www.scopus.com/inward/record.url?scp=84893245696&partnerID=8YFLogxK

U2 - 10.1145/2523649.2523662

DO - 10.1145/2523649.2523662

M3 - ???researchoutput.researchoutputtypes.contributiontobookanthology.conference???

AN - SCOPUS:84893245696

SN - 9781450320153

T3 - ACM International Conference Proceeding Series

SP - 189

EP - 198

BT - Proceedings - 29th Annual Computer Security Applications Conference, ACSAC 2013

T2 - 29th Annual Computer Security Applications Conference, ACSAC 2013

Y2 - 9 December 2013 through 13 December 2013

ER -

Socket overloading for fun and cache-poisoning

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this