Re: [v6ops] <draft-ietf-v6ops-464xlat-optimization-00.txt> - pre-(shepherd-writeup) review

[Erik Nygren <[e-mail]>]

On Wed, Jul 15, 2020 at 5:23 AM Jen Linkova <[e-mail]> wrote:

> On Fri, Jul 10, 2020 at 9:29 PM JORDI PALET MARTINEZ
> <[e-mail]> wrote:
> > [Jordi] If instead of the spoofing the AAAA, it is spoofed the A or even
> the AAAA (without this optimization), the result is the same. In my opinion
> it all depends on how and "where" the attack occurs, because the DNS cache
> may be poisoned in the CPE or the hosts, etc.
>
>
> Sorry I should have clarified. The difference is that spoofing *one*
> DNS response would affect *all* devices behind the CPE *even* if those
> device are not using that CPE as a resolver and use DNS over [smth]
> and/or DNSSEC. My laptop might build a secure tunnel to the DNS server
> it's using and validate response using DNSSEC.
> But it does not help because my TV asked for an A RR and the
> corresponding AAAA was spoofed on the CPE, so now all devices in my
> house can not reach that IPv4 address.
>

It's also not just a matter of spoofing.  All it takes is for one device
to get tricked into doing an A/AAAA looking for a legitimate name
(eg, URL embedded in an advertisement or even email) and
if the attacker controls the name being looked up they can
put in a redirection for an IPv4 address of their choice (which
could belong to someone else) to an IPv6 address of their choice
(which could belong to the attacker).  As this is a legit name,
it could be happily DNSSEC signed as well.  The problem is that
an attacker can return an A record for IP space they don't own.

The collision invalidation may help in some cases, but it won't help
for cases where other clients in the local network are using DoH
or are caching and using A records well past their DNS TTL (common
in some cases like older Java).
This is a fairly serious new attack vector that is very easy to exploit
(much more so than DNS spoofing).
If we see deployment of this, we should expect to see people attacking
it this way to bad effect.

    Erik