The attacker poisons a DNS cache to take over authority for a given domain. The attacker then creates a phishing page and tries to steal user's usernames/passwords. There are two classes of experiments that need to be combined:

1. an experiment where a DNS cache is poisoned, subclass of cache poisoning experiments
2. an experiment where a phishing attack is conducted via a Web page to steal usernames/passwords

Example 2: DNS cache poisoning for phishing

This example used two metadescriptions. Let's go through each of them. This example is written in [CurrentlyProposedLanguage].

Cache poisoning metadescription

• Logical topology:

Objects:

Attacker extends Node

Name, fakeResource extends String

Cache extends Object

Cache := {String[] records}

Cardinality:

|Attacker|₁

|Name|₁

|fakeResource|₁

|Cache|₁

Relationships:

not collocated(Cache, Attacker)

• Timeline of events:

Definitions:

Attacker a, Cache c, Name n, fakeResource fr

e1 := {type = REPLY, origin = a, destination = c, content = (n=fr)}

s1 := {c.records += (n=fr)}

Timeline:

e1 -> s1

• Invariants: Nothing in addition to the topology and timeline above.

DNS Cache poisoning metadescription

This is a special case of cache poisoning where the target is DNS cache.

• Logical topology:

Objects:

Attacker extends Node

Auth extends Node

Name extends DNSName

RealIP extends IPAddress

FakeIP extends IPAddress or fakeAuth extends DNSName

victimCache extends Object

victimCache := {DNSRecord[] records}

authCache extends Object

authCache := {DNSRecord[] records = {Name=RealIP, auth(domain(Name)) = Auth}

Cardinality:

|Attacker|₁

|Auth|₁

|Name|₁

|FakeIP|₁

|fakeAuth|₁

|RealIP|₁

|victimCache|₁

|authCache|₁

Relationships:

not collocated(victimCache, Attacker)

not collocated(victimCache, Auth)

collocated(authCache, Auth)

• Timeline of events:

Definitions:

Attacker att, Auth auth, Name n, FakeIP fIP, fakeAuth fauth, RealIP rIP, victimCache vc, authCache ac

e1 := {type = DNSREQUEST, origin = att, destination = vc, content = IP(n)?}

e2 := {type = DNSREQUEST, origin = vc, destination = auth, content = IP(n)?}

e3 := {type = DNSREPLY, origin = auth, destination = vc, content = {n=rIP}}

e4 := {type = DNSREPLY, origin = auth, destination = vc, content = {n=unknown}}

e5 := {type = DNSREPLY, origin = att, destination = vc, content = {auth(domain(n)) = dnsname(fakeAuth)}}

s1 := {vc.records += (auth(domain(n)) = fakeAuth)}

e6 := {type = DNSREPLY, origin = att, destination = vc, content = {n=fIP}}

s2 := {vc.records += (n=fIP)}

Timeline:

e1 -> e2 -> (e5 -> s1 -> e4 xor e6 -> s2 -> e3)

• Invariants: Nothing in addition to the topology and timeline above.

Confidential access metadescription

The phishing attempt is essentially same as presenting a valid page to the user that asks for confidential info - it's just that the location of that page is not as user expected.

• Logical topology:

Objects:

User extends Human

Server extends webServer

Page extends webPage

Public, Confidential extends String

Cardinality:

|User|₁

|Server|₁

|Page|_>=1

|Public|₁

|Confidential|₁

Relationships:

collocated(Page, Server)

• Timeline of events:

Definitions:

User u, Server s, Public p, Confidential c, Page wp

e1 := {type = WEBREQUEST, origin = u, destination = s, content = url(wp)}

e2 := {type = WEBREQUEST, origin = s, destination = u, content = (public?, confidential?)}

e3 := {type = WEBREPLY, origin = u, destination = s, content = (public=x, confidential=y)}

e4 := {type = WEBREPLY, origin = s, destination = u, content = wp}

Timeline:

e1 -> e2 -> e3 -> if (x == p and y == c) then e4

• Invariants: Nothing in addition to the topology and timeline above.

Experiment design

Now I'm a user who wants to design an experiment. I need to combine two metadescriptions (DNS cache poisoning and phishing) and somehow tie them down to generator choices. To combine I'll do something like this:

DNSCachePoisoning dcp, confidentialAccess ca

dcp.FakeIP := ip(ca.Server)

dcp -> ca