DNS Birthday Attack Revival Exploits EDNS Client Subnet to Poison Modern Resolvers

Researchers from Nankai University revived the DNS birthday attack, a 2002-vintage cache poisoning technique presumed dead, by exploiting the EDNS Client Subnet (ECS) extension in modern DNS resolvers. The attack bypasses query aggregation—a long-standing defense—by sending hundreds of queries for the same domain with spoofed subnets, forcing resolvers to issue multiple upstream requests and amplifying the attacker’s odds via the birthday paradox. Testing revealed 18 of 22 major DNS software implementations (including BIND, Unbound, and PowerDNS) and hardware from 16 vendors (e.g., TP-Link, Cisco, ASUS) were vulnerable, with 365,000 open resolvers exposed in internet-wide scans. The flaw stems from RFC 7871’s permissive handling of ECS and resolvers’ failure to enforce strict consistency checks, enabling off-path attackers to inject forged responses without EDNS formatting. Lab trials achieved a 100% success rate in 20 attempts, poisoning caches in under six minutes, while real-world measurements confirmed 14 of 45 public DNS services were exploitable. The team disclosed findings to affected vendors, resulting in 35 CVEs and patches (e.g., Unbound’s fix), while advocating for protocol-level revisions to RFC 7871. The research underscores how new DNS extensions can undermine legacy security assumptions, even in foundational protocols.