SAD DNS brings back off-path DNS cache poisoning by splitting one 32-bit guess (16-bit source port plus 16-bit transaction ID) into two 16-bit guesses. The side channel is Linux’s global ICMP rate limit, a token bucket of 50 shared across all destinations. The attacker sends 50 spoofed UDP probes to candidate ports, each from a different source IP to dodge the per-IP limit. Every closed port spends a token on an ICMP port-unreachable reply; an open port spends none. A final probe from the attacker’s real address to a known closed port then gets a reply only if a token is left, which tells the attacker whether the batch held an open port. With the port known, the attacker floods spoofed answers over all transaction IDs, and stretches the attack window by muting the real name server, for example by abusing its response rate limiting.
Findings
- Over 34% of the open resolvers measured were vulnerable, and 85% of popular DNS services, including Google’s 8.8.8.8.
- The global limit caps scanning near 1,000 ports per second, so sweeping all 65,536 ports takes a little over a minute. Repeated attempts are independent trials, so success comes quickly.
- Against a real home router (Xiaomi R3, forwarding to 1.1.1.1), which has no global limit, the attacker instead took 240 addresses over DHCP to get round the per-IP limit. 20 of 20 attempts succeeded within 30 minutes, averaging 271 s (103 s collecting addresses, 168 s scanning and injecting), with about 36,325 ports scanned and 78 MB of traffic.
- BIND, Unbound and dnsmasq on Linux are affected. Windows and FreeBSD (global limit 200) and macOS (250) have the same kind of limit.
- Tested, with permission, against a production resolver serving 70 million queries a day.
Limits
- Needs IP spoofing (the paper cites 30.5% of ASes not filtering spoofed sources) and a way to make the victim issue a query.
- Needs the victim OS to send ICMP errors. Blocking outgoing port-unreachable messages closes this channel.
- DNSSEC and 0x20 encoding stop it where deployed, and the authors note how rarely they are.
- The kernel fix randomises the limit; the follow-up paper finds other channels.
Relevance
For robots, any resource a victim shares with an attacker (a rate limiter, a queue, a radio’s airtime) can leak state, even when every bad packet is filtered correctly. A spoofed message that a robot rejects can still change something the attacker can measure. See robot-security, cyber-physical-security and robust robotics.