Your Shield is My Sword: A Persistent Denial-of-Service Attack via the...
summary
Describes RUC, an attack that injects unvalidated DNSSEC troubleshooting responses (via CD bit queries) into resolver caches and causes persistent validation failures during normal lookups. Three concrete variants target DS/KEY records, delegated name‑server IPs, and RUC EDS0 behavior; off‑path injection uses predict-IP-ID fragment injection of large DNS responses. Empirical scan shows 5 major DNSSEC validators vulnerable, 28 of 29 public DNS services affected, and >60% of open resolvers with hundreds of thousands at risk of >24‑hour outages. BIND, Cloudflare and OpenDNS issue patches; fixes restrict TTL and reuse scope.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:58DNSSEC troubleshooting
- 3:44RU attack phases
- 5:30RU attack variants
- 7:15On-path and off-path attacks
- 8:41Affected systems
- 9:46Mitigation strategies
- 10:49Summary
related talks
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
01h 27mDNS at 30
23mTsuKing: Coordinating DNS Resolvers and Queries into Potent DoS Amplifiers
26mPhoenix Domain Attack: Vulnerable Links in Domain Name Delegation and Revocation
32mDNS as Added Security Against Ransomware Attacks
20mEnd-Users Get Maneuvered: Empirical Analysis of Redirection Hijacking in Content Delivery Networks
26mMisuse of DNS, the Second Most Used Protocol
47mDNS On Fire