2

Is it possible to protect against DNS cache snooping on ISC bind and PowerDNS servers? If not, is there a similar DNS server software which can't protect agains snooping?

0

1 Answer 1

1

Because cache snooping is enabled by a properly operating caching DNS server, there's no way for the DNS server to thwart it without breaking proper caching behavior. For example, you could make a DNS server hand out all responses with a synthetic TTL, but then the use case of having individual TTL for different records is being overridden.

It is possible to poison the cache as a defensive measure. For example, let's say the attacker is using the cache to identify anti-virus software in use. If the defender has a program which regularly queries the DNS records used by various anti-virus software that isn't in use, then the attacker will be get indicators for multiple anti-virus packages, with most of them being false.

I wrote a program to do this a couple years ago called dnSense.

2
  • I only found this for a DNS server which is not common: support.simpledns.plus/kb/a125/…
    – jwalker
    Commented Apr 18, 2020 at 9:55
  • @jwalker ...which tells you how to turn the cache off completely. Yes, that will prevent cache snooping, at the cost of "breaking proper caching behavior."
    – gowenfawr
    Commented Apr 18, 2020 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .