Cache Test

Professional attackers use advanced attack techniques, operate in a targeted and efficient manner, and thus pose advanced persistent threats. A gateway for many such network attacks are the servers of large companies and service providers that are responsible for routing virtually all network traffic: the Domain Name System (DNS) servers. Haya Schulmann has developed a testing procedure that can be used to scan these DNS servers for vulnerabilities without causing damage or triggering false alarms in security systems: Cache Test is already implemented as a web-based solution and can be tried for free at https://cache-test.cad.sit.fraunhofer.de/index.html. One click starts the scan - after 10 to 15 minutes, testers receive an evaluation of the DNS infrastructure they use.

Cyber-attacks on DNS infrastructure

Cache poisoning is a common type of attack on the internet designed to manipulate the Domain Name System (DNS), which is used to route data traffic and convert the hostnames contained in URLs into IP addresses – for example, https://www.sit.fraunhofer.de into 141.12.16.230. In such attacks, criminals or state-sponsored attackers alter entries in the DNS cache of corporate networks. If successful, attackers can, for example, redirect or intercept emails, carry out phishing attacks or launch denial-of-service attacks. The Cache Test procedure developed at Fraunhofer SIT enables operators of DNS servers to identify cache poisoning vulnerabilities.

How does Cache Test work?

Cache Test is currently available to users free of charge. The web-based solution uses the tester’s browser to initiate DNS queries. Specifically, the browser attempts to load images from the internet. To do this, it uses the web addresses associated with the images, which are resolved using the Domain Name System (the DNS name is part of a web URL). Depending on the design and configuration of the testers’ DNS infrastructure, the corresponding DNS queries arrive at the Cache Test infrastructure in different forms and sequences, enabling conclusions to be drawn about the DNS services under investigation and their configuration.

Cache Test carries out 14 tests, with each individual DNS query repeated between 10 and 30 times. In doing so, Cache Test analyses the queries sent to its own DNS servers, from which the test results are derived. The solution summarises the results in a brief report, which provides information on vulnerabilities and misconfigurations in the affected DNS servers. Protective measures can then be derived from this: sometimes a software update or a change to the server settings is sufficient, but on other occasions the software may need to be replaced or completely reinstalled.