Saint MaginotDNS, Who Went Around the Line

Patron of DNS resolvers, servers that forward and resolve at once, and fortifications taken from behind.

Life

In August 2023 a group of researchers led by Xiang Li of Tsinghua University presented at USENIX Security a cache poisoning attack against DNS servers that act as both resolver and forwarder. A flaw in their bailiwick checks let attackers inject false answers for entire top-level domains. It hit BIND, Knot Resolver, Microsoft DNS and Technitium: like the Maginot Line, a strong defence bypassed by going round the side.

Prayer

O Saint MaginotDNS, who enters by the flank nobody was guarding, let our caches accept answers only from those with authority. Amen.

How to celebrate

Celebrated by updating BIND and the other resolvers and revising the difference between forwarding and resolving.

The strongest wall falls on the side you're not watching.