Prof. Yehuda Afek

First this paper measures and analyzes various trade-offs be-
tween different DNSSEC configurations, such as, NSEC, NSEC3, aggressive caching, and online vs. offline signing. These measurements expose a trade-off between (1) aggressive cashing DNSSEC configuration that provides excellent performance (higher robustness to DDoS attacks) but is vulnerable to zone enumeration attacks in addition to offline signing disadvantages, and (2) online signing DNSSEC configuration, that prevents. Second, following these, we suggest and evaluate an alternative, Adaptive DNS over QUIC, (AdaDoQ), an adaptive, efficient and secure communication layer between a DNS resolver and the authoritative servers, that offers a better trade-off between DDoS resiliency and security. Under normal load conditions the resolver commu
nicates with each authoritative server with standard DNSSEC however,
when the traffic load increases, AdaDoQ switches to a QUIC connection
with heavily communicating authoritative server(s), for as long as the
traffic load is high. The public key of the authoritative ZSK (which is
verifiable through the DNSSEC chain of trust) is integrated into the symmetric key creation in QUIC to provide a DNSSEC level of authenticity
and security. AdaDoQ ensures DNS authenticity, good throughput, and
disables zone walking attacks, DNS hijacking, and cache poisoning.

With the goal of improving the security of Internet protocols, we seek faster, semi-automatic methods to discover new vulnerabilities in protocols such as DNS, BGP, and others. To this end, we introduce the LLM-Assisted Protocol Attack Discovery (LAPRAD) methodology, enabling security researchers with some DNS knowledge to efficiently uncover vulnerabilities that would otherwise be hard to detect.

LAPRAD follows a three-stage process.
In the first, we consult an LLM (GPT‑o1) that has been trained on a broad corpus of DNS-related sources and previous DDoS attacks to identify potential exploits.
In the second stage, a different LLM automatically constructs the corresponding attack configurations using the ReACT approach implemented via LangChain (DNS zone file generation).
Finally, in the third stage, we validate the attack’s functionality and effectiveness.

Using LAPRAD, we uncovered three new DDoS attacks on the DNS protocol and rediscovered two recently reported ones that were not included in the LLM’s training data. The first new attack employs a bait-and-switch technique to trick resolvers into caching large, bogus DNSSEC RRSIGs, reducing their serving capacity to as little as 6%. The second exploits large DNSSEC encryption algorithms (RSA‑4096) with multiple keys, thereby bypassing a recently implemented default RRSet limit. The third leverages ANY-type responses to produce a similar effect.
These variations of a cache-flushing DDoS attack, called SigCacheFlush, circumvent existing patches, severely degrade resolver query capacity, and impact the latest versions of major DNS resolver implementations.

We present a novel yet simple and comprehensive DNS
cache POisoning Prevention System (POPS), designed
to integrate as a module in Intrusion Prevention Systems
(IPS). POPS addresses statistical DNS poisoning attacks—
documented from 2002 to the present—and offers
robust protection against similar future threats. It comprises
a detection module, which employs three simple rules, and
a mitigation module that leverages the TC flag in the DNS
header to enhance security. Once activated, the mitigation
module has zero false positives or negatives, correcting any
such errors on the side of the detection module. Thus, the
detection module is allowed to err on the false positive side
while minimizing false negatives.
We first analyze POPS against historical DNS services
and attacks, showing that it would have mitigated all network-based statistical poisoning attacks. We then simulate POPS on traffic benchmarks (PCAPs) incorporating current potential network-based statistical poisoning attacks, and benign PCAPs; the simulated attacks still succeed with a probability of 0.0076%. This occurs because five malicious packets go through before POPS detects the attack and activates the mitigation module. In addition, POPS completes its task using only 20%–50% of the time required by other tools (e.g., Suricata or Snort), and after examining just 5%–10% as many packets. It successfully detects DNS cache poisoning attacks—including fragmentation-based variants—that Suricata and Snort consistently miss, highlighting POPS’s superiority.

In this paper, we present DNS FLaRE, a DNS cache-based timing side-channel attack that allows an attacker to accurately infer the times at which a user visits specific websites.
We demonstrate the attack on DNS forwarders, a widely used  component of the DNS infrastructure that acts as an  intermediary cache between DNS clients and recursive resolvers.
The threat model assumes only that the victim is tricked into visiting a malicious website. We show that the attack can accurately infer the times at which a user visits specific websites by exploiting discrepancies in the DNS resolution times of a domain, depending on whether it is in the forwarder cache or not. Furthermore, when targeting IoT devices, the attack can infer when certain events were taking place at an IoT device.
This is enabled by observing IoT related DNS resolution  discrepancies by a browser in the same household. The attack facilitates sophisticated phishing attacks, IoT device detection and profiling and other potential privacy implications.