ResolFuzz: Differential Fuzzing of DNS Resolvers

(2023) ResolFuzz: Differential Fuzzing of DNS Resolvers.

Text resolfuzz-esorics2023.pdf Download (876kB)

Abstract

This paper identifies and analyzes vulnerabilities in the DNS infrastructure, with particular focus on recursive DNS resolvers. We aim to identify semantic bugs that could lead to incorrect resolver responses, introducing risks to the internet’s critical infrastructure. To achieve this, we introduce ResolFuzz, a mutation-based fuzzer to search for semantic differences across DNS resolver implementations. ResolFuzz combines differential analysis with a rule-based mechanism to distinguish between benign differences and potential threats. We evaluate our prototype on seven resolvers and uncover multiple security vulnerabilities, including inaccuracies in resolver responses and possible amplification issues in PowerDNS Recursor’s handling of DNAMEResource Records (RRs). Moreover, we demonstrate the potential for self-sustaining DoS attacks in resolved and trust-dns, further underlining the necessity of comprehensive DNS security. Through these contributions, our research underscores the potential of differential fuzzing in uncovering DNS vulnerabilities.

Item Type:	Conference or Workshop Item (A Paper) (Paper)
Divisions:	Christian Rossow (System Security Group, SysSec)
Conference:	ESORICS European Symposium On Research In Computer Security
Depositing User:	Christian Rossow
Date Deposited:	07 Sep 2023 18:36
Last Modified:	07 Sep 2023 18:36
Primary Research Area:	NRA3: Threat Detection and Defenses
URI:	https://publications.cispa.saarland/id/eprint/4033

Actions

Actions (login required)

View Item