论文标题
NXNSATTACK：递归DNS效率低下和脆弱性
NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities
论文作者
论文摘要
本文暴露了一个新的漏洞，并引入了相应的攻击，即不存在的名称服务器攻击（NXNSATTACK），该攻击会破坏并可能使DNS系统瘫痪，从而使Internet用户难以访问网站，Web电子邮件，在线视频聊天或任何其他在线资源。 NXNSATTACK在DNS解析器和DNS权威名称服务器之间产生了一系列数据包。风暴是由解析器对权威名称服务器无限制的转介响应消息的响应产生的。该攻击比NxDomain攻击（例如，Mirai攻击）更具破坏性：i）在递归解析器交换的数据包数量上，它达到了超过1620x的扩增因子。 ii）除了负缓存外，攻击还饱和解析器缓存的“ NS”部分。为了减轻攻击影响，我们提出了对递归解析算法（Maxfetch（k））的增强，从而防止了不必要的主动提取。我们在绑定解析器上实现了MaxFetch（1）缓解措施增强，并在现实世界DNS查询数据集上进行了测试。我们的结果表明，Maxfetch（1）既不会降解递归解析器吞吐量也没有降低其延迟。在发现攻击之后，执行了负责任的披露程序，几家DNS供应商和公共提供商已发行了CVE并修补了他们的系统。
This paper exposes a new vulnerability and introduces a corresponding attack, the NoneXistent Name Server Attack (NXNSAttack), that disrupts and may paralyze the DNS system, making it difficult or impossible for Internet users to access websites, web e-mail, online video chats, or any other online resource. The NXNSAttack generates a storm of packets between DNS resolvers and DNS authoritative name servers. The storm is produced by the response of resolvers to unrestricted referral response messages of authoritative name servers. The attack is significantly more destructive than NXDomain attacks (e.g., the Mirai attack): i) It reaches an amplification factor of more than 1620x on the number of packets exchanged by the recursive resolver. ii) In addition to the negative cache, the attack also saturates the 'NS' section of the resolver caches. To mitigate the attack impact, we propose an enhancement to the recursive resolver algorithm, MaxFetch(k), that prevents unnecessary proactive fetches. We implemented the MaxFetch(1) mitigation enhancement on a BIND resolver and tested it on real-world DNS query datasets. Our results show that MaxFetch(1) degrades neither the recursive resolver throughput nor its latency. Following the discovery of the attack, a responsible disclosure procedure was carried out, and several DNS vendors and public providers have issued a CVE and patched their systems.
