  In spite of the availability of DNSSEC, which protects against cache
poisoning even by MitM attackers, many caching DNS resolvers still rely for
their security against poisoning on merely validating that DNS responses
contain some 'unpredictable' values, copied from the re- quest. These values
include the 16 bit identifier field, and other fields, randomised and validated
by different 'patches' to DNS. We investigate the prominent patches, and show
how attackers can circumvent all of them, namely: - We show how attackers can
circumvent source port randomisation, in the (common) case where the resolver
connects to the Internet via different NAT devices. - We show how attackers can
circumvent IP address randomisation, using some (standard-conforming)
resolvers. - We show how attackers can circumvent query randomisation,
including both randomisation by prepending a random nonce and case
randomisation (0x20 encoding). We present countermeasures preventing our
attacks; however, we believe that our attacks provide additional motivation for
adoption of DNSSEC (or other MitM-secure defenses).
