Detecting and Measuring Security Implications of Entangled Domain Verification in CDN

Ziyu Lin,Zhiwei Lin,Run Guo,Jianjun Chen,Mingming Zhang,Ximeng Liu,Tianhao Yang,Zhuoran Cao,Robert H. Deng

2024-09-03

Abstract:Content Delivery Networks (CDNs) offer a protection layer for enhancing the security of websites. However, a significant security flaw named Absence of Domain Verification (DVA) has become emerging recently. Although this threat is recognized, the current practices and security flaws of domain verification strategies in CDNs have not been thoroughly investigated. In this paper, we present DVAHunter, an automated system for detecting DVA vulnerabilities that can lead to domain abuse in CDNs. Our evaluation of 45 major CDN providers reveals the prevalence of DVA: most (39/45) providers do not perform any verification, and even those that do remain exploitable. Additionally, we used DVAHunter to conduct a large-scale measurement of 89M subdomains from Tranco's Top 1M sites hosted on the 45 CDNs under evaluation. Our focus was on two primary DVA exploitation scenarios: covert communication and domain hijacking. We identified over 332K subdomains vulnerable to domain abuse. This tool provides deeper insights into DVA exploitation and allows us to propose viable mitigation practices for CDN providers. To date, we have received vulnerability confirmations from 12 providers; 6 (e.g., Edgio, Kuocai) have implemented fixes, and 1 (ChinaNetCenter) are actively working on solutions based on our recommendations.

Cryptography and Security

What problem does this paper attempt to address?

The problem that this paper attempts to solve is the security threat of domain name abuse in the Content Delivery Network (CDN) due to the lack or defective Domain Verification Absence (DVA). Specifically, the paper focuses on:

1. **Lack or Defects in Domain Verification Mechanisms**: Many CDN providers do not conduct sufficient domain name verification during the deployment of domain names and the request forwarding process, or their domain name verification mechanisms are defective. This enables attackers to exploit these vulnerabilities to abuse domain names and carry out malicious activities, such as distributing malware and circumventing network censorship.

2. **Specific Scenarios of Domain Name Abuse**: The paper explores two main scenarios of domain name abuse:
- **Covert Communication**: Through methods such as Domain Fronting and Domain Borrowing, attackers can hide malicious traffic within seemingly legitimate traffic.
- **Domain Hijacking**: By exploiting Dangling DNS Records, attackers can take over domain names with undeleted DNS records, thereby controlling the content under the domain name or stealing sensitive data.

3. **Large - scale Evaluation and Detection**: Although existing research has identified some DVA vulnerabilities in CDNs, there is a lack of an automated large - scale evaluation tool. Therefore, the paper proposes an automated system named DV AHunter for large - scale detection of DVA vulnerabilities in CDNs and evaluation of their severity.

In summary, the main objective of this paper is to systematically investigate the domain name verification mechanisms in CDNs and their security vulnerabilities, propose an automated large - scale detection system (DV AHunter), and through the evaluation of 45 major CDN providers, reveal the deficiencies in the current CDN domain name verification strategies and provide improvement suggestions for CDN providers.