First Try DNS Cache Poisoning with IPv4 and IPv6

Travis Palmer presents a comprehensive technical breakdown of DNS cache poisoning via IP fragmentation attacks across both IPv4 and IPv6 resolvers. Palmer revisits the historical context of DNS vulnerabilities, noting how Dan Kaminsky's 2008 cache poisoning attack led to the adoption of UDP source port randomization (combining a 16-bit transaction ID and a 16-bit UDP source port to provide 32 bits of entropy).

[12:12] Palmer explains how IP fragmentation fundamentally circumvents port randomization. In fragmented UDP packets, the entire DNS header—containing the transaction ID, source port, and destination port—is encapsulated solely within the first IP fragment. The subsequent second fragment contains only the answer section (resource records). If an attacker can inject a spoofed second fragment that matches the resolver's reassembly queue, they do not need to guess the UDP port or the TXID at all; they only need to predict the IP Identification (IP ID) field.

[21:22] The talk demonstrates how attackers can deliberately induce fragmentation by sending ICMP "Packet Too Big" (Path MTU discovery) messages or querying domains with large responses. Palmer dismantles the prevailing assumption that IPv6 is immune to fragmentation poisoning due to its 32-bit IP ID field. He details an attack methodology using ICMPv6 echo request probes [27:41] to elicit fragmented responses, measure and predict the resolver's IP ID counter, and successfully poison cache records on the first attempt. He concludes with mitigation strategies [40:44], including dropping incoming DNS fragments, lowering EDNS0 buffer sizes in line with DNS Flag Day recommendations, enforcing TCP fallback, and deploying DNSSEC.

(AI summary — Gemini Flash)