Intercept and Inject: DNS Response Manipulation in the Wild

Yevheniya Nosyk (1, 2, 3) , Qasim Lone (4) , Yury Zhauniarovich (5) , Carlos H Gañán (5, 6) , Emile Aben (4) , Giovane C M Moura (5, 7) , Samaneh Tajalizadehkhoob (8) , Andrzej Duda (1, 2, 9) , Maciej Korczyński (1, 2, 9)

1 LIG - Laboratoire d'Informatique de Grenoble
2 Drakkar
3 UGA - Université Grenoble Alpes
4 RIPE NCC - Réseaux IP Européens Network Coordination Centre [Amsterdam]
5 TU Delft - Delft University of Technology
6 ICANN
7 SIDN Labs
8 ICANN
9 Grenoble INP - Institut polytechnique de Grenoble - Grenoble Institute of Technology

DNS is a protocol responsible for translating human-readable domain names into IP addresses. Despite being essential for many Internet services to work properly, it is inherently vulnerable to manipulation. In November 2021, users from Mexico received bogus DNS responses when resolving whatsapp.net. It appeared that a BGP route leak diverged DNS queries to the local instance of the k-root located in China. Those queries, in turn, encountered middleboxes that injected fake DNS responses. In this paper, we analyze that event from the RIPE Atlas point of view and observe that its impact was more significant than initially thought-the Chinese root server instance was reachable from at least 15 countries several months before being reported. We then launch a nine month longitudinal measurement campaign using RIPE Atlas probes and locate 11 probes outside China reaching the same instance, although this time over IPv6. More broadly, motivated by the November 2021 event, we study the extent of DNS response injection when contacting root servers. While only less than 1% of queries are impacted, they originate from 7% of RIPE Atlas probes in 66 countries. We conclude by discussing several countermeasures that limit the probability of DNS manipulation.

Mots clés: DNS; root servers; DNS manipulation; DNS censorship; BGP route leaks

Domaines: Réseaux et télécommunications [cs.NI]

Yevheniya Nosyk, Qasim Lone, Yury Zhauniarovich, Carlos H Gañán, Emile Aben, et al.. Intercept and Inject: DNS Response Manipulation in the Wild. International Conference on Passive and Active Network Measurement, Mar 2023, Virtual Event, Spain. pp.461-478, ⟨10.1007/978-3-031-28486-1_19⟩. ⟨hal-04027480⟩