Speaker
Description
DNS resolvers are normally evaluated using well-formed queries, leaving a fundamental attack surface comparatively underexplored: what happens when a malformed query reaches the resolver's front door?
In this talk, we present QuerySynth, an LLM-guided framework that translates natural-language DNS specifications into executable protocol tests. QuerySynth processed 299 DNS RFCs, constructed a Structured Protocol Model containing 134 expert-validated constraints, and generated 756 normalized malformed-query vectors. Differential testing across mainstream recursive resolvers and forwarders found that 89.41% of these vectors triggered inconsistent externally observable behavior.
Our analysis uncovered three exploitable classes of query-processing behavior, collectively termed the JIGGLE Attack. First, some resolvers include attacker-controlled query content in error responses. Combined with IP fragmentation, this behavior enables a pulsing denial-of-service attack with a measured bandwidth amplification factor of 1,083.2x. The same reflection behavior can also provide a one-way covert channel. Second, inconsistent validation between forwarding resolvers and upstream servers can induce predictable upstream silence, creating a multi-second window that strengthens existing off-path cache-poisoning attacks.
To assess the operational impact, we measured 44 public DNS services and 1,315,016 open resolvers. We observed anomalous echo behavior in 18 public services and 75,711 open resolvers, while 852,770 open resolvers exhibited relevant silent behavior. Overall, 924,808 resolvers, or 70.33% of the measured population, exhibited at least one JIGGLE-related behavior.
Responsible disclosure has led to concrete remediation. Unbound released a public fix that prevents malformed-query reflection, covert-channel behavior, and inappropriate silence. AdGuard Home published a security advisory and added JIGGLE protections, while Technitium DNS Server and several public DNS operators confirmed, fixed, or investigated the reported behaviors.
The talk concludes with practical guidance for resolver developers and operators: reject malformed input consistently, return minimal error responses, never reflect arbitrary query content, avoid forwarding semantically ambiguous queries, and improve observability so that rate limiting and parser rejection can be distinguished from upstream failure.
| Talk duration | 15 Minutes (pre-recorded no Q&A) |
|---|
