MaginotDNS: Attacking the Boundary of DNS Caching Protection
summary
MaginotDNS is a cache‑poisoning technique that targets CDNS (resolvers that forward and recurse) by breaking bailiwick checking and injecting forged NS records into shared caches. Proof includes a lab demo that overwrites a zone’s NS records in ~800 seconds, combination of MaginotDNS scripts with an ICMP port‑probe side channel (SS) and TXID/source‑port brute force, and vendor testing showing 154,000 CDNS discovered with ~33% vulnerable; BIND and Microsoft DNS variants are shown exploitable (Microsoft uses ~2,500 ports; BIND attack succeeds after thousands of runs).
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:13Outline
- 4:55Basic DNS Attacks
- 8:13DanKaminski Attack
- 12:12DS Resolver
- 14:07Attack
- 14:48Software Analysis
- 16:14Bic Checking
- 17:27Cs
- 18:41Unpass
- 22:23Microsoft DS
- 23:04Demo
- 25:47Scanning
- 26:19Results
- 27:15Summary
related talks
25mDark Side of the DNS Force
31mNew Techniques for Split-Second DNS Rebinding
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
16mDNS FLaRE: A Flush-Reload Attack on DNS Forwarders
47mDNS On Fire
16mAttacking with Something That Does Not Exist: 'Proof of Non-Existence' Can Exhaust DNS...
34mPractical Steps for Reducing Exposure and Detecting Compromise
26mMisuse of DNS, the Second Most Used Protocol