topic Re: xfinity dns cache poisoning events? in Network Security

xfinity dns cache poisoning events?

Pat Fahey — Fri, 21 Feb 2020 15:37:08 GMT

Seeing a lot of these events in the log:

PROTOCOL-DNS potential dns cache poisoning attempt - mismatched txid (3:21355:5)

Firepower seems to be finding something about xfinity DNS (75.75.75.75, 75.75.76.76) that it does not like.

Has anyone found a good way to deal with the messages?

Thanks for your help.

----------------------------------------------

UPDATE: The message indicates an earlier DNS message format that can be exploited. I solved the problem by disabling the rule.

Re: xfinity dns cache poisoning events?

Bogdan Nita — Thu, 19 Apr 2018 10:07:42 GMT

It might also indicate that somebody is trying to poison the dns cache.

DNS uses only a 16-bit transaction ID to check the response is valid, although most of the dns servers today will check the TXID is valid a lot of dns responses with false TXID could indicate that somebody is trying to guess the value.

https://www.cs.cornell.edu/~shmat/shmat_securecomm10.pdf

HTH

Bogdan

Re: xfinity dns cache poisoning events?

Pat Fahey — Fri, 20 Apr 2018 04:50:16 GMT

I'll turn the rule back on and try to capture the packets next time it hits.