On Wed, Apr 22, 2026 at 12:52 AM Mukund Sivaraman <[email protected]> wrote:
> Hello Ben > > On Tue, Apr 21, 2026 at 04:41:28PM -0400, Ben Schwartz wrote: > > > We can expect that a DoS on DNSSEC will be much more > > > rare than attacks on unsigned zones. > > > > > > > I disagree. "Man on the side" attacks on DNS, by injecting a forged > reply > > that races the true reply, are common, and are not limited to unsigned > > domains. > > Are you claiming unsuccessful attacks are common, or successful attacks > are common? > Successful attacks (against non-validating resolvers or unsigned domains) are common in certain countries [1] and occasionally end up applying elsewhere [2]. [1] https://www.usenix.org/system/files/sec21-hoang.pdf [2] https://securityaffairs.com/86808/security/china-telecom-traffic-hijacking.html Do you have any statistics or empirical data on successful off-path > attacks being commonplace against a non-NAT'd resolver that does UDP > source port randomization, uses an actual random message ID, and > disables outgoing ICMP error messages (preventing SAD DNS attacks)? > I am discussing an "on-path" attacker who is "on the side" in the sense that they do not (or cannot) drop packets, only add more packets. The forged response races the real response (and wins), leading to cache poisoning (if no DNSSEC) or Bogus status and a SERVFAIL response. A "DNSSEC Hold On" policy (keeping the UDP listener open until timeout if the initial response was Bogus) would mitigate this attack behavior, forcing the injection-only attacker to become a blocking attacker (which is substantially more expensive to deploy and maintain). --Ben
_______________________________________________ DNSOP mailing list -- [email protected] To unsubscribe send an email to [email protected]
