EXAMENSARBETE INOM DATATEKNIK, GRUNDNIVÅ, 15 HP STOCKHOLM, SVERIGE 2020 Cache Poisoning in DNS over HTTPS clients Cache-förgiftning hos DNS över HTTPS klienter EMILIA BLIDBORG CAROLINE GUNNARSSON KTH SKOLAN FÖR KEMI, BIOTEKNOLOGI OCH HÄLSA Cache Poisoning in DNS over HTTPS clients Cache-förgiftning hos DNS över HTTPS klienter Emilia Blidborg Caroline Gunnarsson Examensarbete inom Datateknik Grundnivå, 15 hp Handledare på KTH: Martin Jacobsson Examinator: Ibrahim Orhan TRITA-CBH-GRU-2020:047 KTH Skolan för kemi, bioteknologi och hälsa 141 52 Huddinge, Sverige Abstract DNS over HTTPS (DoH) is a protocol used to send traditional DNS traffic over HTTPS. This causes the DNS name resolving traffic to be encrypted and transmitted over the same port as regular HTTPS traffic. This thesis maps a number of previous vulnerabilities in DNS and compares those risks with the DoH protocol and its implementation, mainly focusing on cache poisoning. A number of attacks from a DoH server to a DoH client are applied. The results show that it is possible to inject incorrect data into the DoH client’s cache. The consequences of this can be extensive, an example of this is a redirect to a malicious web page, which when using DoH can be difficult to detect because the DNS traffic is encrypted. Further work is needed to mitigate the security holes discovered, as well as to further identify potential threats. Keywords DNS over HTTPS, DoH, cache poisoning, RFC 8484, DNS security, DANE Sammanfattning DNS över HTTPS (DoH) är ett protokoll som används för att skicka traditionell DNS trafik över HTTPS. Detta medför att trafiken blir krypterad och sänds över samma port som vanlig HTTPS trafik. Denna rapport kartlägger ett antal tidigare sårbarheter i DNS och jämför dessa risker med DoH protokollet och dess implementation, främst med fokus på cache-förgiftning. Ett antal attacker från en DoH server till en DoH klient tillämpas. Resultatet visar att det är möjligt att injicera felaktig data i DoH klientens cacheminne. Konsekvenser av detta kan bli omfattande, ett exempel kan vara en omdirigering till en skadlig webbsida, vilket vid användning av DoH kan vara svårupptäckt på grund av att DNS traffiken är krypterad. Vidare arbete krävs för att förmildra de säkerhetshål som upptäcks, samt att ytterligare identifiera potentiella hot. Nyckelord DNS över HTTPs, DoH, cache-förgiftning, RFC 8484, DNS säkerhet, DANE Acknowledgements We want to thank Internetstiftelsen for this opportunity and provision of equipment needed to carry out this study. We want to give an extra thanks to Ulrich Wisser at Internetstif- telsen for all the support and guidance during the study. We also want to thank Martin Jacobsson, who has been our mentor at KTH throughout this study. Glossary CA Certificate Authority. DANE DNS-based Authentication of Named Entities. DDOS Distributed Denial of Service. DNS Domain Name System. DNSSEC Domain Name System Security Extension. DoH DNS over HTTPS. HTTP Hypertext Transfer Protocol. HTTP/2 Hyper Transfer Protocol Version 2. HTTPS Hypertext Transfer Protocol Secure. IDS Intruder Detection System. IPSEC Internet Protocol Security. ISP Internet Service Provider. MITM Man-in-the-middle. PKI Public key infrastructure. RFC Request for Comments. RR Resource Record. SNI Server Name Indication. TLS Transport Layer Security. TRR Trusted Recursive Resolver. Contents 1 Introduction 1 1.1 Problem statement . 1 1.2 Goals of the project . 1 1.3 Scope of the project and delimitations . 2 2 Theory and background 3 2.1 A brief introduction to DNS . 3 2.1.1 DNS flags . 3 2.1.2 DNS message . 4 2.1.3 DNSSEC . 4 2.2 DNS over HTTPS . 5 2.2.1 The DoH package . 5 2.2.2 Errors . 6 2.2.3 Cache . 6 2.2.4 Security . 7 2.3 Hyper Transfer Protocol Version 2 . 7 2.3.1 Streams & Multiplexing . 7 2.3.2 Server push . 7 2.3.3 Initialization phase . 8 2.4 DoH and browsers . 8 2.5 Weaknesses of DoH . 9 2.5.1 User privacy and parental control . 10 2.5.2 Security view . 10 2.6 Previous work regarding DoH . 11 2.7 Previous known attacks and vulnerabilities in DNS . 12 2.7.1 Attacks against resolvers . 12 2.7.2 Man-in-the-middle attack . 12 2.7.3 Cache attacks . 12 2.7.4 Other attacks . 13 2.8 DNS-based Authentication of Named Entities . 14 3 Methodology and Results 15 3.1 Research methodology . 15 3.2 Argument for choice of client . 15 3.3 Lab enviroment . 16 3.3.1 DoH server . 16 3.3.2 DoH client . 17 3.3.3 Webserver . 18 3.4 Choice for modification of code . 18 3.5 Injection tests . 19 3.6 Compilation of results . 24 4 Analysis and discussion 25 4.1 Analysis of results . 25 4.2 Conclusion of the goal . 26 4.3 Consequences . 26 4.4 Error margins . 27 4.5 Economic, social, ethical and environmental aspects . 28 4.6 Other aspects and solutions . 29 5 Conclusions 31 5.1 Future works . 31 5.2 Recommendations . 32 6 References 35 INTRODUCTION | 1 1 Introduction The Domain Name System (DNS) is a vital part of the Internet and a requirement for its full functionality. Almost all services available on the Internet rely on and start with a DNS query, which has the main task of translating domain names into IP addresses. DNS was developed in 1984 by Paul Mockapetris [1]. When building its structure, the security was not the main consideration. Due to that they did not think there would be a matter of integrity. At the same time, the protocol is constantly evolving to make the name translation more efficient and secure. DNS over HTTPS (DoH) [2] is one of the protocols that has been developed to meet these vulnerabilities. The protocol establishes encrypted connections to send DNS queries and responses through. Firefox already supports this technology and their browser will be used as a DoH client for this study. 1.1 Problem statement DoH is a relatively new technique for managing DNS queries. As popular web browsers have begun to implement the technology, an examination of the protocol is important. The protocol is based on HTTP/2 [3], and the main goal is to achieve integrity by encrypting the communication between client and resolver. This means that the DNS queries are encrypted and not sent in plaintext as previously, and also sent over the well-known port 443 and thus inseparable from regular HTTPS traffic. Is this a problem or is it only an advantage for privacy? There is a lot of ongoing discussions about the protocol, including privacy and who owns the huge amount of DNS data being transported. This data may contain sensitive information about users, such as IP address and browsing habits. Since queries are only encrypted part of the transport route, these data are also visible to some extent for certain nodes in the chain. Is it possible to apply known DNS vulnerabilities to DoH? Does DoH prevent Internet Service Providers (ISPs) from tracking user data? Or does this only centralize the DNS traffic? 1.2 Goals of the project As this is such a new area, this study will examine any possible exploits or security vul- nerabilities that the protocol or its implementation may cause users. Both from the user’s expectation of the protocol but also flaws in the design. The main area that will be ex- amined is the possibility to inject false information into a web browser’s cache memory and thus send the wrong IP address to the clients and redirect them to the wrong website. This study will also examine the lack of integrity in the protocol. 2 | INTRODUCTION The goals of this study were presented by Internetstiftelsen. And three main goals were developed: • Examine if there is any unknown vulnerability regarding the protocol DoH, with focus on cache poisoning attacks. • Analyze which known DNS vulnerabilities the protocol DoH is able to protect against. • Investigate how a typical DoH client handles data that has not been requested. In addition to these main goals, the following sub-goals were formulated: • Study the structure of DoH packages. • Study the DNS name resolve cache of the web browser. • Investigate who has access to sensitive user data. • Map what users of the protocol expect, and what they actually get. • Develop a DoH server that intends to provide client with manipulated DNS data. 1.3 Scope of the project and delimitations This project only covers the evaluation of the protocol DoH. Other protocols, also designed to make DNS lookup safer, is only taken into consideration when discussing future work. Due to time limitations, only a few of the potential threats found were tested in the lab environment, and others are only discussed in a later chapter. THEORY AND BACKGROUND | 3 2 Theory and background This chapter covers the presentation of previous work in the field, as well as the underlying theory. The DNS over HTTPS (DoH) protocol is reviewed and implementations that support the protocol are presented. Previously known vulnerabilities with regular DNS are studied, in order to be able to evaluate the protocol DoH easier later in the study. 2.1 A brief introduction to DNS The purpose of this section is to introduce DNS and its functions on the internet and is aimed for readers who do not have enough knowledge in the field. With the help of DNS, the user does not need to remember the IP address of the web server to which the connection is to be made, the user can instead remember an alias name. The Domain Name System (DNS) is a distributed system [1], it is hierarchical and structured as a tree to facilitate the search.