Fragmentation Considered Poisonous

We present practical poisoning and name-server blocking attacks on standard DNS resolvers, by off-path, spoofing adversaries. Our attacks exploit large DNS responses that cause IP fragmentation; such long responses are increasingly common, mainly due to the use of DNSSEC. In common scenarios, where DNSSEC is partially or incorrectly deployed, our poisoning attacks allow ‘complete’ domain hijacking. When DNSSEC is fully deployed, attacker can force use of fake name server; we show exploits of this allowing off-path traffic analysis and covert channel. When using NSEC3 opt-out, attacker can also create fake subdomains, circumventing same origin restrictions. Our attacks circumvent resolver-side defenses, e.g., port randomisation, IP randomisation and query randomisation. The (new) name server (NS) blocking attacks force resolver to use specific name server. This attack allows Degradation of Service, traffic-analysis and covert channel, and also facilitates DNS poisoning. We validated the attacks using standard resolver software and standard DNS name servers and zones, e.g., org.