DNS FLaRE: A Flush-Reload Attack on DNS Forwarders
summary
Claims a practical cache timing side channel that infers when specific sites or IoT events occur by flushing and reloading home DNS forwarder caches. Attack uses a DoS-based cache flashing method, a port 0 timing trick (and HTTP fallbacks) to force measurable DNS resolution, cross-origin subdomains to bypass browser partitioning, and 30s sampling loops. Built and tested end-to-end: direct DNS gives 86% accuracy, HTTP about 60%, and vendor patches or mitigations are mixed.
AI-written summary · about
chapters (12)
- 0:00DNS FLaRE attack intro
- 1:58DNS forwarder cache basics
- 3:05Flashing the DNS forwarder cache
- 4:12Attack challenges
- 5:57Timing reload with port zero
- 7:43Bypassing other caches
- 9:07Network state partitions
- 10:33Browser and OS cache variations
- 12:41Measuring extra domains
- 13:26Results and accuracy
- 14:12Detecting IoT activity
- 14:54Mitigations and responses
related talks
29mMaginotDNS: Attacking the Boundary of DNS Caching Protection
25mDark Side of the DNS Force
20mEnd-Users Get Maneuvered: Empirical Analysis of Redirection Hijacking in Content Delivery Networks
26mMisuse of DNS, the Second Most Used Protocol
31mNew Techniques for Split-Second DNS Rebinding
47mDNS On Fire
22mDNS is Under Attack - the Miscreant's Offensive Playbook with a Defensive Counter
24mSide-Channel Attacks on Everyday Applications