> For the complete documentation index, see [llms.txt](https://sliu583.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sliu583.gitbook.io/blog/networking/index/cs-268-adv-network/ethics/the-collateral-damage-of-internet-censorship-by-dns-injection.md). # The collateral damage of internet censorship by DNS injection https\://conferences.sigcomm.org/sigcomm/2012/paper/ccr-paper266.pdf ### Summary * Great Firewall of China injects DNS responses to restrict access to domain names * This affects traffic originating outside China * 26.4% of open resolvers affected * .de is the most affected TLD (70% of open resolvers in kr) * Explain how, where, and why this happens * Present several possible solutions * Restricting access to computers outside China

DNS Explain

DNS Injection

* DNS injection * Affects both inbound and outbound queries * Typically does not suppress "correct" response, wins the race to respond * Query to Chinese AS --> respond a different IP address \[injected responses] ### Methodology * HoneyQueries: detect autonomous system paths to whom see DNS injection * DNS query to sensitive domains, sent to unresponsive IP * Assumptions: all observed DNS responses are from DNS injectors * Sent from a single vantage point (AS 40676) * 14 million IPs that cover /24 subnets * Paths spread to discover all injecting autonomous systems * Record IPs in responses: lemon IPs * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FK7ymDRWDzJ4aUy4sYHR7%2Fimage.png?alt=media\&token=42603e1e-54c8-488c-8a9e-a3cf6bf205d0) * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FtuFMbG3tVfQOO1bI2AFx%2Fimage.png?alt=media\&token=25577745-9600-4d6e-a90a-97d1f9a07e96) * TraceQueries: identify location of injectors on affected paths * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FQj3AdFmi2LR9JI9MhZYg%2Fimage.png?alt=media\&token=feddc76a-eae2-4cc2-8f35-a0d4e5bec605) * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FGEkYTjry4aaG0RQhZRgg%2Fimage.png?alt=media\&token=3ad96370-6d90-4a4c-aa27-79f3c0c56033) * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FEPBtLk1AyQTMkYErUpeo%2Fimage.png?alt=media\&token=54ebfe8e-7ed8-4025-9235-2bab7242d6b4) * TCP-based queries will not be injected against * StepNXQueries: measure collateral damage of DNS injection * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FhFUwnOS0jcFmAG6AszUs%2Fimage.png?alt=media\&token=52fd3e56-f754-4f4f-8b79-106644c890f2) * Who's affected * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FghmJ5bl7Stl813L5TqDE%2Fimage.png?alt=media\&token=7475e5c0-6d38-4a66-8cb5-43407fb5ccc5) * This is surprising! * Whose resolvers? * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FU6XWcTlZzFonOSE31dCp%2Fimage.png?alt=media\&token=e55491fb-6cca-4270-85e5-eee37c11ac13) * Details * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FpMYqad4E0WdrVvn68VdE%2Fimage.png?alt=media\&token=15fe03eb-a012-4780-8335-b04f6e00dcd1) * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FOayhd28xabCp39nIUfme%2Fimage.png?alt=media\&token=a3eed3f6-5f81-47ea-8f14-af9ae123b2c9) * Solutions * DNS injectors could filter out transit queries * Autonomous systems could avoid transit through injecting neighbors * Particularly, TLD operators could monitoring peering paths * Security extensions for DNS (DNSSEC) prevent injection * DNSSEC has signed responses * Resolvers would reject injected responses, accept slower ones from authoritative servers * .de and .kr both support DNSSEC * Conclusion * ![](https://2097630930-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MVORxAomcgtzVVUqmws%2Fuploads%2FiLU8Mojdc57PF0DK1o7g%2Fimage.png?alt=media\&token=c6b36a3d-6e60-4bfc-a32a-e5123baf68f6)