Phoenix Domain Attack: Vulnerable Links in Domain Name Delegation and Revocation
summary
Claim: Phoenix Domain lets revoked domains stay resolvable at scale by abusing DNS cache operations; two exploit types (T1 injects NS records as cached entries expire, T2 injects subdomain NS records iteratively). Attack is based on reverse‑engineering cache behavior across eight DNS implementations and affects mainstream resolvers without breaking DNS specs. Empirical results: tested 41 public resolvers and ~1.2M resolvers list, 89% vulnerable to T2, 42% still exploitable after 100 injections, 40% after one week, 25% after one month; six mitigations are proposed.
AI-written summary · about
chapters (13)
- 0:00Phoenix Domain Attack intro
- 3:26Domain revocation process
- 4:34Goose fix limitations
- 8:18Discovery of attack
- 9:42DS cache analysis
- 11:33T1 attack mechanism
- 16:36T2 attack mechanism
- 19:53Testing on public resolvers
- 20:58T2 short-term impact
- 21:19Long-term impact
- 22:23Vulnerable resolver geolocation
- 22:46Mitigation approaches
- 24:16Root causes and defenses
related talks
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection
01h 27mDNS at 30
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
12mYour Shield is My Sword: A Persistent Denial-of-Service Attack via the...
25mDark Side of the DNS Force
31mNew Techniques for Split-Second DNS Rebinding
34mPractical Steps for Reducing Exposure and Detecting Compromise
23mTsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers