arXiv:2608.00643 · v2

Domain Decoupling Attack: Exploiting the Validation Gap Between Protective DNS and Shared Edge Routing

首次提交 2026-08-01 20:56

版本更新 2026-10-27 03:39

雷达观测 2026-10-29 00:35

摘要

Command-and-control, data transfer, and censorship circumvention can hide in traffic to widely used services. DNS-bound access control grants permits based on resolved IP addresses, while shared edges route requests by tenant identity, creating a validation gap. An attacker can resolve an allowed anchor, obtain a permit for its shared edge address, and access a hidden tenant by presenting the tenant's name as both SNI and HTTP Host. To investigate this gap, we present the Domain Decoupling Attack (DDA), which exploits this gap in CDN and non-CDN hosting while preserving SNI--Host consistency. Across 1,069,048 domains, we conduct 18,025,068 successful probes. Overall, 95.8% of domains accept an external SNI, and 84.6% return content matching the named tenant. Exposure reaches 99.26% across 506,763 CDN domains and 92.75% across 562,285 non-CDN domains. The co-location graph places 666,413 exposed domains in cross-tenant components; 97.7% of 54,069 cross-tenant non-CDN addresses have a confirmed path to another tenant. None of the tested defenses bind tenant identity to the DNS-approved name. Cleartext inline IPS can block access based on SNI, but Encrypted Client Hello (ECH) hides it. The Windows Zero Trust DNS (ZTDNS) permit remains reusable in both cases, enabling the concealment of command-and-control and data-exfiltration traffic and facilitating censorship circumvention. The risk conceals command-and-control and data-exfiltration traffic and supports censorship.