Attacking with Something That Does Not Exist: 'Proof of Non-Existence' Can Exhaust DNS...
summary
A containerized testbed generates large NSEC3-signed zones and measures resolvers (Bind, Unbound, PowerDNS, Knot) under crafted NX records. The evaluation implements the NSEC3-encloser attack, shows up to a 72x increase in CPU instruction count versus normal validation, and demonstrates packet-loss with as little as 150 malicious NSEC3 records per second (benign loss 2.7–30%, peak ~35%). Attack code, zonefiles and data are published on GitHub.
AI-written summary · about
chapters (11)
- 0:00ANC attack project
- 1:17DNS non-existence proofs
- 3:46NSEC3 closest encloser proof
- 5:32Attack mechanics and RFC 9276
- 7:20Evaluation system for DNS resolvers
- 8:04Testing major DNS resolvers
- 9:30Salt impact on attack
- 10:34Resolver resilience comparison
- 11:38Denial of service impact
- 13:44Vulnerable domains analysis
- 15:09Conclusion
related talks
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection
26mMisuse of DNS, the Second Most Used Protocol
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
34mUsing DNS as a layer of defense
01h 27mDNS at 30
25mDark Side of the DNS Force
15mYou Depend on DNS, This Is How It Works and You Won't...
12mYour Shield is My Sword: A Persistent Denial-of-Service Attack via the...