Mitigating DNS fragmentation attacks

[js...@letsencrypt.org]

There’s a paper from 2013 outlining a fragmentation attack on DNS that allows an off-path attacker to poison certain DNS results using IP fragmentation[1]. I’ve been thinking about mitigation techniques and I’m interested in hearing what this group thinks.

I've started a thread over at the Let's Encrypt community forum. Please feel free to join in if you have thoughts! https://community.letsencrypt.org/t/mitigating-dns-fragmentation-attack/74838

[1]: https://u.cs.biu.ac.il/~herzbea/security/13-03-frag.pdf

[Paul Wouters]

On Oct 14, 2018, at 21:09, jsha--- via dev-security-policy <dev-secur...@lists.mozilla.org> wrote:
>
> There’s a paper from 2013 outlining a fragmentation attack on DNS that allows an off-path attacker to poison certain DNS results using IP fragmentation[1]. I’ve been thinking about mitigation techniques and I’m interested in hearing what this group thinks.
>

The mitigation is dnssec. Ensure your data is cryptographically protected.

Paul

[Tom Ritter]

That would be nice, but as that is not available to everyone, a
comprehensive solution is also desirable.

-tom