Intercept and Inject: DNS Response Manipulation in the Wild

DNS is a protocol responsible for translating human-readable domain names into IP addresses. Despite being essential many Internet services to work properly, it inherently vulnerable manipulation. In November 2021, users from Mexico received bogus responses when resolving whatsapp.net. It appeared that BGP route leak diverged queries the local instance of k-root located in China. Those queries, turn, encountered middleboxes injected fake responses. this paper, we analyze event RIPE Atlas point view and observe its impact was more significant than initially thought—the Chinese root server reachable at least 15 countries several months before reported. We then launch nine-month longitudinal measurement campaign using probes locate 11 outside China reaching same instance, although time over IPv6. More broadly, motivated by 2021 event, study extent response injection contacting servers. While only less 1% are impacted, they originate 7% 66 countries. conclude discussing countermeasures limit probability