POPS: From History to Mitigation of DNS Cache Poisoning Attacks
summary
POPS is an IPS module that combines three simple rules for detection with a mitigation that flips the DNS TC flag to force TCP; the mitigation claims zero false negatives and corrects detection false positives. Simulations on PCAPs show attacks still succeed with probability 0.0076% because up to five malicious packets slip through before mitigation activates. POPS completes detection in 20%–50% of the time and inspects only 5%–10% of packets compared to Suricata/Snort, and it catches fragmentation and out‑of‑jurisdiction glue attacks those tools miss.
AI-written summary · about
chapters (6)
- 0:00POPS and DNS poisoning
- 1:17Statistical DNS poisoning attacks
- 5:59Fragmentation-based poisoning attacks
- 9:54Out-of-bailiwick poisoning attacks
- 13:50Comparison with existing systems
- 15:36Conclusion and future work
related talks
30mLessons From Defending The Indefensible
28mA World-View of IP Spoofing in L4 Volumetric DoS Attacks - and a Call to Enable BCP38
34mPractical Steps for Reducing Exposure and Detecting Compromise
52mInvestigating DDOS - Architecture Actors and Attribution
27mAbuse of CPE Devices and Recommended Fixes
36mDefense Against Rapidly Morphing DDOS
58mEvasion of High-End IDPS Devices at the IPv6 Era
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter