Destination-Side Source Address Validation (DSAV) Report for AS29296 (IPv4)
This page contains a report of the IPv4 DSAV status of AS29296.
DSAV (destination-side source address validation) is the filtering of
spoofed incoming traffic at the network border. AS29296 was tested
and found to be vulnerable. Our methodology consisted of issuing spoofed
queries to DNS resolvers within the AS using source IP addresses appearing
to originate from the AS itself. Failure to filter spoofed traffic such as this
facilitates attacks which could otherwise be prevented, such as DNS cache poisoning.
We ran our experiment in December 2019.
Our work has been accepted to the Internet Measurement Conference (IMC) 2020,
which will take place late October. While we will present our results
in-aggregate only and will not specifically mention your autonomous system,
we recommend resolving this issue soon before there is greater general
awareness of the vulnerability.
For questions questions about this report, please see our
Frequenty Asked Questions (FAQ) page.
Internal DNS Resolvers Reached by Spoofed-Source Queries
Each of the IP addresses below acted on our spoofed queries, indicating that our spoofed
queries successfully penetrated the network.
5 classes of source addresses were spoofed. These include:
Itself
The destination itself used as the source address.Localhost
127.0.0.1 for IPv4 and ::1 for IPv6.Private
192.168.0.10 for IPv4 and fc00::10 for IPv6.Same Prefix
Addresses from the same /24 (IPv4) or /64 (IPv6) prefix as the destination (other than the destination itself).Same ASN
Addresses from the same ASN as the destination but outside the /24 or /64 prefix.
Additionally, for some resolvers we were able to infer the host operating system by either 1) eliciting a TCP-based query to our authoritative servers and analyzing the TCP query using p0f,
or 2) analyzing the range of source ports used by the resolver when querying our server and comparing the range used to known
ephemeral port selection strategies.
Finally, we classify each resolver reached as open or closed, based off of whether or not it queried our server
in response to an un-spoofed query. Note that even reaching an open resolver indicates a lack of DSAV, as the
traffic would have been blocked at the network border had DSAV been in place.