Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Models

POPS: From History to Mitigation of DNS Cache Poisoning Attacks

Speakers: Yehuda Afek, Professor, Tel Aviv University; Harel Berger, Lecturer, Ariel University; Anat Bremler-Barr, Professor, Tel Aviv University

Conference: USENIX Security

Paper page: https://www.usenix.org/conference/usenixsecurity25/presentation/afek

Overview

This article delves into "POPS: From History to Mitigation of DNS Cache Poisoning Attacks," a pivotal work presented at USENIX Security. Authored by Yehuda Afek, Harel Berger, and Anat Bremler-Barr, this research introduces the POisoning Prevention System (POPS), a novel, simple, and comprehensive solution designed to integrate seamlessly as a module within existing Intrusion Prevention Systems (IPS). The paper meticulously analyzes the evolution of DNS cache poisoning attacks from 2002 to the present, demonstrating how POPS offers robust protection against both historical vulnerabilities and similar future threats.

DNS cache poisoning remains a persistent and critical cybersecurity challenge, capable of redirecting users to malicious websites, facilitating phishing, credential theft, and malware infections. Despite the existence of countermeasures like DNS Security Extensions (DNSSEC) and increased randomization, universal protection has remained elusive, largely due to limited adoption and the reactive nature of current defenses. POPS addresses this gap by offering a proactive, two-stage system comprising a detection module with three simple, historically-derived rules and a mitigation module that leverages the TC flag in the DNS header to enforce secure communication.

The significance of POPS lies in its ability to provide quick and accurate detection with minimal overhead, coupled with a mitigation strategy that boasts zero false positives or negatives once activated. The system's unique approach allows its detection module to err on the side of false positives, knowing that the mitigation module will correct any such errors, thereby minimizing critical false negatives. This article will unpack the technical intricacies of POPS, its performance against historical and simulated attacks, its superior capabilities compared to conventional tools like Suricata and Snort, and its profound implications for network defenders seeking to fortify their DNS infrastructure against sophisticated poisoning attempts.

Background

The Domain Name System (DNS) is the foundational directory service of the internet, translating human-readable domain names (e.g., example.com) into machine-readable IP addresses (e.g., 192.0.2.1). This translation process, known as DNS resolution, is hierarchical, involving a sequence of queries from a resolver to various name servers (root, top-level domain, authoritative) until the authoritative name server for the requested domain provides the corresponding IP address. Upon receiving a response, the resolver validates parameters such as the source port, Transaction ID (TXID), domain name, and the source IP address of the authoritative name server before caching the resource record (RR) and delivering the IP address to the client.

DNS cache poisoning attacks exploit vulnerabilities in this process by injecting false information into a DNS resolver’s cache. This manipulation causes the resolver to return a malicious IP address for a legitimate domain, effectively redirecting users to attacker-controlled sites. Such attacks can lead to severe consequences, including phishing, credential theft, and malware distribution. Despite ongoing efforts, DNS cache poisoning has remained a persistent threat, with new variants continuously emerging.

The paper focuses on the more prevalent type of DNS poisoning: delivering spoofed authoritative responses by faking the authoritative name server's IP address and guessing critical parameters like the TXID and source port. More complex methods, such as BGP hijacking or Man-in-the-Middle (MITM) attacks, are acknowledged but fall outside the scope of this study.

Historically, several mitigation attempts have been made:

• DNS Security Extensions (DNSSEC): Proposed in 1997, DNSSEC aims to eliminate poisoning through cryptographic authentication. However, its global adoption remains low (less than 30%) due to its reliance on authoritative server implementation.
• Increased Randomization: After attacks like the infamous Kaminsky attack in 2008, DNS resolvers implemented randomization of both TXIDs and source ports, requiring attackers to guess 32 bits instead of 16. However, subsequent attacks have found ways to reduce this guesswork back to 16 bits by predicting or pinning one of the parameters.
• Machine Learning (ML): Approaches like Anax [68] have used ML to detect anomalous DNS traffic, but these often struggle against more advanced or novel threats.

The paper categorizes statistical DNS poisoning attacks into four major types:

• Type S (Statistical): The attacker sends numerous forged responses with different combinations of source port and TXID, hoping to guess the correct pair. This brute-force injection is a common tactic.
• Type SFrag (Statistical Fragmentation): The attacker sends a forged second fragment containing malicious data. By tricking the resolver into issuing a query whose response requires fragmentation, and guessing the IP identification (IPID), the attacker can cause the resolver to reassemble a legitimate first fragment with the malicious second fragment.
• Type BFrag (Bullseye Fragmentation): Similar to SFrag, but the attacker knows the IPID by other means, requiring only a single malicious second fragment.
• Type SOoB (Statistical Out-of-Bailiwick): The attacker exploits resolvers that improperly handle DNS records pertaining to domains outside the authority of the queried name server. By including an out-of-bailiwick (OoB) record with a malicious mapping in a forged response, the attacker can poison the cache.

The threat model for POPS assumes an off-path network-based attacker targeting resolvers during the DNS resolution process. The attacker brute-forces TXID and source port predictions and uses the UDP transport protocol unless forced otherwise. Attacks involving MITM, BGP hijacking, direct resolver compromise, or those exploiting syntactic vulnerabilities are explicitly out of scope, as are TCP session hijacking attacks due to their high entropy requirements in the absence of privileged capabilities. This focused threat model allows POPS to concentrate on the most prevalent and persistent forms of DNS cache poisoning.

Key Findings

POPS represents a significant advancement in the defense against DNS cache poisoning, demonstrating several key findings and contributions:

• Comprehensive Coverage of Statistical Attacks: POPS effectively addresses all network-based statistical DNS poisoning attacks documented from 2002 to the present, including S, SFrag, BFrag, and SOoB types. Its detection rules are derived from a historical analysis, making it robust against known and similar future threats.
• Quick and Accurate Detection with Minimal Overhead: The system can detect poisoning attacks in under 1 second, often after observing as few as five suspicious packets. This rapid detection is achieved using efficient algorithms like Count-Min Sketch (CMS) for Rℓ1 (Excessive Guessing of TXID/Port).
• Mitigation with Zero False Positives and Negatives: Once activated, POPS's mitigation module achieves perfect accuracy. By leveraging the TC flag to force suspected UDP DNS responses to TCP, it guarantees that only authentic responses from the legitimate authoritative server are accepted. This design allows the detection module to err on the side of false positives, as they are corrected by the subsequent TCP handshake, ensuring no legitimate DNS queries are dropped or incorrectly resolved.
• Superior Performance over Traditional IDS/IPS: POPS significantly outperforms traditional Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) like Suricata and Snort. It completes its task using only 20%–50% of the time required by these tools and after examining just 5%–10% as many packets. Critically, POPS successfully detects fragmentation-based variants of DNS cache poisoning that Suricata and Snort consistently miss.
• Proactive CVE Mitigation: The system retroactively demonstrates its capability to mitigate 14 specific CVEs related to DNS cache poisoning, rendering vulnerable DNS software systems immune to these exploits. This proactive defense reduces the need for constant patching and vigilance against newly discovered vulnerabilities of these types.
• Low Attack Success Rate (ASR): In simulations incorporating current potential network-based statistical poisoning attacks, the attacker's success rate (ASR) against POPS was reduced to a mere 0.0076%. This occurs because POPS detects the attack and activates its mitigation module after only five malicious packets, significantly limiting the attacker's window of opportunity.
• Efficient Memory Usage: Even under extreme loads of 1 billion responses per second, the CMS within POPS requires only 1,043,712 bits (∼128 KB) of memory, while maintaining a guaranteed error bound below 0.1%. For typical scenarios, a 4KB CMS is sufficient to achieve a 0% false positive rate on benign traffic, demonstrating its scalability and efficiency.

These findings collectively highlight POPS as a robust, efficient, and proactive defense mechanism against the persistent threat of DNS cache poisoning, offering a significant improvement over existing reactive and less comprehensive solutions.

Technical Deep Dive

POPS is engineered as a two-stage system, integrating a detection module and a mitigation module, designed to function as an IPS component. Its core strength lies in its ability to identify suspicious DNS traffic patterns and then enforce a secure communication channel for verification.

Detection Module: Three Simple Rules

The detection module employs three simple, yet powerful, rules (Rℓ1, Rℓ2, Rℓ3) derived from an extensive analysis of historical DNS cache poisoning attacks. These rules are designed to capture the unique attributes of statistical DNS cache poisoning.

1. Rℓ1: Excessive Guessing of TXID/Port: This rule targets statistical attacks (Type S) where an attacker sends numerous forged responses, varying only the port or TXID, in an attempt to guess the correct combination.

• Mechanism: POPS monitors DNS response packets that differ solely in their source port or TXID for the same DNS query within a short time window (e.g., ∼1 second). When the number of such responses exceeds a predefined threshold (τ, e.g., 5 packets), these responses are flagged as a potential poisoning attack.
• Algorithmic Approach: To efficiently count these occurrences in high-volume traffic, POPS utilizes Count-Min Sketch (CMS). CMS is a probabilistic data structure for estimating frequencies of events in a data stream. It hashes each item (domain name in this case) into a fixed set of counters and returns the minimum value across them. This provides an efficient, memory-light solution with a tunable trade-off between memory and accuracy. The paper found CMS to be superior to other frequency estimation algorithms like Fixed-size Distinct Weighted Sampling (dwsHH) and Fixed-threshold Distinct Weighted Sampling (WS) for this application.
• CMS Parameters: The accuracy and memory usage of CMS are influenced by d (number of hash functions) and w (number of cells per hash function). More hash functions reduce error, and more cells improve estimate accuracy. For example, a configuration of w=200 and d=5 yielded a 1% false positive rate, while w=500 and d=2 achieved 0% false positives.
• Operation: The domain name of each packet is added to the CMS table. If its frequency exceeds the threshold τ within the window W, it's flagged. Periodically, the CMS is reset for new time windows.

1. Rℓ2: Fragmentation: This rule addresses fragmentation-based attacks (Type SFrag, BFrag) where malicious data is injected via IP fragments.

• Mechanism: POPS monitors the IP offset and the MF (More Fragments) flag in incoming IP packets. If a packet has an offset of zero and the MF flag is set, it indicates the first fragment of a fragmented DNS response. Any subsequent fragments (where the offset is greater than zero) are immediately discarded. The first fragment, if detected, is passed to the mitigation module.
• Resource Consumption: This rule requires no additional data storage, making it extremely efficient.

1. Rℓ3: Out of Bailiwick: This rule targets Out-of-Bailiwick (OoB) attacks (Type SOoB) where an attacker attempts to inject records for domains outside the authority of the queried name server.

• Mechanism: POPS identifies DNS responses where the queried domain does not comply with the Bailiwick rule (i.e., the response includes records for a domain that the responding name server is not authoritative for). Such packets are immediately flagged as suspicious.
• Resource Consumption: Similar to Rℓ2, this rule requires no additional data storage.

When any of these rules flag a response as suspicious, its content (answer, authoritative, and additional records) is erased, and the packet is immediately forwarded to the mitigation module.

Mitigation Module: Leveraging the TC Flag

The mitigation module is the second, crucial stage of POPS, designed to achieve zero false positives and negatives.

• TC Flag Utilization: When the detection module flags a suspicious response, POPS sets the TC (Truncated) flag in the DNS header to true (TC=1). This action serves a dual purpose:

1. It signals to the resolver that the UDP packet was truncated (even if it wasn't due to size), implying that the full response should be requested via TCP.
2. All data in the answer, authoritative, and additional sections of the suspicious UDP response are removed before forwarding. This prevents the resolver from caching any potentially malicious data from the truncated UDP packet, addressing findings that some resolvers might incorrectly process truncated data.

• UDP to TCP Fallback: By forcing the resolver to re-query the authoritative name server over TCP, POPS leverages the inherent security properties of TCP. TCP is a connection-oriented protocol that establishes a stateful connection via a three-way handshake and uses sequence numbers for reliable data transfer. This process makes spoofing virtually impossible without privileged network access (outside the study's threat model). The resolver thus obtains an authentic, non-poisonous response directly from the legitimate authoritative name server.
• Handling Non-Cooperating Resolvers: A small percentage of resolvers (e.g., 2.67% according to APNIC Labs [76], 1.78% according to Moura et al. [77]) do not initiate a TCP query after receiving a truncated UDP response. POPS is not compatible with these resolvers. Alternative mitigations like setting the time-to-live (TTL) to zero were considered but found less effective due to resolvers ignoring explicit expiration signals.
• Overall Algorithm: The system's final algorithm follows a match-action paradigm. For each incoming DNS response packet, it first applies Rℓ1, Rℓ2, and Rℓ3. If any rule matches, the action is "truncate" (erase data, set TC flag to true). Otherwise, the action is "forward" (send the packet as is).

This two-stage approach allows POPS to maintain high detection rates (even with a tendency for false positives in detection) while guaranteeing the integrity of the final DNS resolution process through the secure TCP fallback, effectively neutralizing DNS cache poisoning attempts.

Demo / Proof of Concept

As this is a peer-reviewed conference paper rather than a live talk, the "Demo / Proof of Concept" section is best understood as a detailed account of the Experiments and Simulation conducted to validate POPS. The authors implemented the detection rules and their testing framework in Golang and Python, making the complete source code available as an artifact. All simulations were performed on a desktop machine with an 11th Gen Intel® Core™i7-1185G7 processor and 32 GB of RAM.

The evaluation methodology involved measuring the attacker’s success rate (ASR) and the false positive (FP) rate of the detection module. A key aspect of the ASR calculation was scaling: if an attacker intended to send 1000 packets but only 5 were transmitted before detection, the success rate was calculated as 0.005. The FP rate was carefully analyzed, with the understanding that false positives from the detection module do not result in actual resolution failures due to the mitigation module's TCP fallback mechanism.

Four distinct experiments were conducted:

1. Rℓ1 Performance Verification: This experiment specifically tested the performance of the Excessive Guessing (Rℓ1) rule. An attacker generated a single query to the resolver, followed by 65,535 responses with different TXIDs (simulating a brute-force attack) and one authentic response from the authoritative server. The attack duration was approximately 400 ms, designed to outpace the authentic response. To simulate a realistic network environment, 1,000 randomly generated benign packets (domains from the Tranco list [81]) were interleaved, reflecting a normative volume of 1,000 DNS queries per second. The experiment also explored different Count-Min Sketch (CMS) configurations, varying the number of hash functions (d = 2, 3, 4, 5) and cells per hash function (w = 100, 200, 500).
2. Rℓ2 Fragmentation Attack Mimicry: This experiment focused on validating the Fragmentation (Rℓ2) rule. It mimicked a second fragmentation attack method, where malicious second fragments are injected, to test POPS's ability to detect and mitigate these specific threats.
3. Rℓ3 Out-of-Bailiwick Attack Generation: This experiment generated an attack specifically designed to violate the Bailiwick rule, thereby testing the effectiveness of the Out of Bailiwick (Rℓ3) rule.
4. Benign Data False Positive Rate Evaluation: The final experiment utilized a large dataset of benign DNS traffic from Mendeley Data [83], comprising over 45 million DNS packets collected over 1.5 days from 4,000 users. After filtering, approximately 6 million relevant DNS responses were analyzed to rigorously evaluate the system's false positive rate under normal, non-attack conditions.

In all experiments, the system parameters were set to a threshold τ of 5 packets and a window size W of 1 second. These parameters were chosen to provide sufficient overhead for normal DNS traffic while being sensitive enough to detect even rapid attacks.

The results consistently showed a very low ASR of 0.0076% across all attack simulations, indicating that POPS effectively neutralizes poisoning attempts. The false positive rates varied depending on CMS configuration: for interleaved attack and benign data, w=200, d=2 yielded a 6% FP rate, while w=200, d=5 dropped it to below 1%, and w=500 with any d achieved 0% FP. On purely benign data, the maximum FP rate observed was approximately 2% (with w=100), but as discussed, these false positives are innocuous because the TCP fallback ensures correct resolution. The experiments confirmed that POPS instantaneously detects fragmentation and out-of-bailiwick attacks due to their single-packet nature. These comprehensive simulations underscore POPS's practical applicability and robust performance in real-world scenarios.

Defensive Implications

The introduction of POPS carries significant implications for network defenders, offering a proactive and robust approach to mitigate one of the internet's most persistent threats: DNS cache poisoning.

Firstly, organizations should consider integrating POPS as a module within their existing Intrusion Prevention Systems (IPS). Its design as a lightweight, rule-based system makes it suitable for deployment at the network edge, protecting internal DNS resolvers. The ability to achieve near-perfect recall (minimizing false negatives) in detection, coupled with the TC flag mitigation's zero false positives, means that defenders can deploy POPS with confidence, knowing that legitimate DNS traffic will not be disrupted while attacks are effectively neutralized.

Secondly, POPS offers a powerful advantage in proactive CVE mitigation. By demonstrating its capability to prevent exploitation of 14 specific CVEs related to DNS cache poisoning across various vendors (e.g., CoreDNS, Microsoft DNS, Technitium, dnsmasq, BIND, PowerDNS), POPS reduces the critical dependency on reactive patching. Defenders using vulnerable DNS software affected by these CVEs can gain immediate protection by deploying POPS, significantly lowering their attack surface and operational burden associated with constant software updates. This shifts the defense paradigm from continuously chasing and patching vulnerabilities to implementing a systemic, architectural safeguard.

Thirdly, the superior performance of POPS compared to traditional IDS/IPS tools like Suricata and Snort is a critical consideration. While Suricata and Snort rely on signature-based detection and aggregate packets by IP address, POPS aggregates by domain name and operates with a much tighter detection window (1 second vs. 2-10 seconds) and fewer packets (5 vs. 50-100). Crucially, POPS detects fragmentation attacks which these tools miss. This means that organizations relying solely on conventional IDS/IPS for DNS protection may be leaving themselves exposed to advanced poisoning techniques. Defenders should evaluate their current DNS security stack against POPS's capabilities.

However, defenders must also be aware of POPS's limitations as acknowledged by the authors. POPS is specifically designed for statistical DNS cache poisoning attacks and does not immediately scale to other types of DNS attacks like DDoS. Furthermore, it does not identify attacks involving BGP hijacking, MITM techniques, or those that bypass the need to guess both port and TXID using advanced capabilities like host malware or compromised middleboxes (which fall outside POPS's threat model). Organizations facing these higher-privilege threats will require additional, complementary security measures.

Finally, the discussion around resolvers that do not honor the TC flag (approximately 2.67% of resolvers) highlights a compatibility challenge. Defenders should assess their resolver fleet to understand if this limitation applies to their infrastructure and consider alternative resolver configurations or upgrades if necessary to ensure full POPS effectiveness.

In summary, POPS empowers defenders with an efficient, accurate, and proactive layer of defense against a wide array of DNS cache poisoning attacks, significantly enhancing the resilience of DNS infrastructure and reducing the burden of reactive security measures.

Key Takeaways

• Comprehensive Protection: POPS effectively mitigates all known network-based statistical DNS cache poisoning attacks, including S, SFrag, BFrag, and SOoB variants, documented from 2002 to the present.
• Rapid & Accurate Detection: The system detects poisoning attempts in under 1 second, often after just five suspicious packets, using efficient rules and Count-Min Sketch (CMS) for frequency estimation.
• Zero False Positives in Mitigation: POPS's unique two-stage design, leveraging the TC flag to force UDP to TCP fallback for suspicious responses, ensures that no legitimate DNS queries are disrupted or incorrectly resolved, guaranteeing perfect accuracy in mitigation.
• Superior Performance: POPS significantly outperforms traditional IDS/IPS tools like Suricata and Snort in detection speed, packet processing efficiency (20-50% faster, 5-10% fewer packets), and its ability to detect fragmentation attacks.
• Proactive CVE Mitigation: The system proactively addresses 14 specific DNS cache poisoning CVEs, reducing the need for constant patching and offering a foundational defense against a broad range of vulnerabilities.
• Efficient and Scalable: POPS maintains high accuracy and minimal memory overhead, with a 4KB CMS sufficient for 0% false positives, and a 128KB CMS capable of handling 1 billion responses per second.

About the Speaker(s)

The paper "POPS: From History to Mitigation of DNS Cache Poisoning Attacks" was authored by a team of distinguished academics:

• Yehuda Afek is a Professor at Tel Aviv University. His research often delves into network security and distributed systems.
• Harel Berger is a Lecturer at Ariel University. His work, including this paper, contributes to the field of network security, particularly focusing on DNS vulnerabilities.
• Anat Bremler-Barr is a Professor at Tel Aviv University. She is a recognized expert in network security, with a focus on intrusion detection and prevention systems.

Their combined expertise in network security, algorithms, and distributed systems underpins the novel and comprehensive approach presented in POPS.