NXNSAtack：递归DNS无效性和漏洞
NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities
摘要：
本文揭示了一个新的漏洞，并介绍了一种相应的攻击，即不存在的名称服务器攻击（NXNSAttack），它会中断并可能瘫痪DNS系统，使Internet用户难以或无法访问网站、Web电子邮件、在线视频聊天或任何其他在线资源。NXNSAttack在DNS解析器和DNS权威名称服务器之间生成数据包风暴。风暴是由解析器对权威名称服务器的无限制引用响应消息的响应产生的。该攻击比NXDomain攻击更具破坏性（例如，Mirai攻击）：i）它在由递归解析器交换的分组的数量上达到大于1620倍的放大因子。ii）除了负缓存之外，攻击还使解析器缓存的“NS”部分饱和。为了减轻攻击的影响，我们提出了对递归解析器算法MaxFetch（k）的增强，以防止不必要的主动获取。我们在BIND解析器上实现了MaxFetch（1）缓解增强，并在真实世界的DNS查询数据集上进行了测试。我们的结果表明，MaxFetch（1）既没有降低递归解析器的吞吐量，也没有降低其延迟。在发现攻击后，进行了负责任的披露程序，几家DNS供应商和公共提供商发布了CVE并修补了他们的系统。
英文摘要：
This paper exposes a new vulnerability and introduces a corresponding attack, the NoneXistent Name Server Attack (NXNSAttack), that disrupts and may paralyze the DNS system, making it difficult or impossible for Internet users to access websites, web e-mail, online video chats, or any other online resource. The NXNSAttack generates a storm of packets between DNS resolvers and DNS authoritative name servers. The storm is produced by the response of resolvers to unrestricted referral response messages of authoritative name servers. The attack is significantly more destructive than NXDomain attacks (e.g., the Mirai attack): i) It reaches an amplification factor of more than 1620x on the number of packets exchanged by the recursive resolver. ii) In addition to the negative cache, the attack also saturates the 'NS' section of the resolver caches. To mitigate the attack impact, we propose an enhancement to the recursive resolver algorithm, MaxFetch(k), that prevents unnecessary proactive fetches. We implemented the MaxFetch(1) mitigation enhancement on a BIND resolver and tested it on real-world DNS query datasets. Our results show that MaxFetch(1) degrades neither the recursive resolver throughput nor its latency. Following the discovery of the attack, a responsible disclosure procedure was carried out, and several DNS vendors and public providers have issued a CVE and patched their systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
