Fragmentation Considered Poisonous

We present practical poisoning and name-server block-ing attacks on standard DNS resolvers, by off-path, spoofing adversaries. Our attacks exploit large DNS responses that cause IP fragmentation; such long re-sponses are increasingly common, mainly due to the use of DNSSEC. In common scenarios, where DNSSEC is partially or incorrectly deployed, our poisoning attacks allow ‘com-plete ’ domain hijacking. When DNSSEC is fully de-ployed, attacker can force use of fake name server; we show exploits of this allowing off-path traffic analy-sis and covert channel. When using NSEC3 opt-out, attacker can also create fake subdomains, circumvent-ing same origin restrictions. Our attacks circumvent resolver-side defenses, e.g., port randomisation, IP ran-domisation and query randomisation. The (new) name server (NS) blocking attacks force re-solver to use specific name server. This attack allows Degradation of Service, traffic-analysis and covert chan-nel, and also facilitates DNS poisoning. We validated the attacks using standard resolver soft-ware and standard DNS name servers and zones, e.g., org.