End-Users Get Maneuvered: Empirical Analysis of Redirection Hijacking in Content Delivery Networks
summary
Measurement of DNS-based CDN mapping shows attackers can replay legitimately signed records to reroute users to chosen edge servers; DNSSEC—even ECDSA live signing—fails to stop replayed dynamic A/CNAME responses. A crawler and targeted cache-penetration curl tests probe many CDN mappings, measure RTT/TTFB/download speed, and find non‑optimal assignments typically add ~300 ms and can drop throughput drastically. Results demonstrate practical risks (DDoS amplification, load‑balancer bypass) and recommend short‑lived signatures plus resolver‑side name flattening.
AI-written summary · about
chapters (7)
- 0:00DNS and security context
- 1:49DNSSEC and its limitations
- 5:21CDN request routing
- 8:01Analysis of CDN vulnerability
- 11:19Performance and impact study
- 14:22Proposed mitigation strategies
- 17:15Conclusion and Q&A
related talks
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
16mDNS FLaRE: A Flush-Reload Attack on DNS Forwarders
19mCloudy with a Chance of Cyberattacks: Dangling Resources Abuse on Cloud Platforms
47mDNS On Fire
26mMisuse of DNS, the Second Most Used Protocol
34mPractical Steps for Reducing Exposure and Detecting Compromise
19mNames and Security
32mDNS as Added Security Against Ransomware Attacks