What is Cache Poisoning?

Cache poisoning is the replacement of legitimately cached web content with spoofed, malicious, or fake data.

Caching web content improves performance on both the server and the client side. Unfortunately, the HTTP protocol used in the caching mechanism only performs integrity checks on the server side. This lack of authentication, including flaws in web applications such as DNS software, gives attackers an opportunity to “poison” the cache respiratory. Once cache poisoning is complete, users accessing the poisoned cache are served illegitimate content, or routed to an IP address controlled by the attacker. This continues until the poisoned cache entry is purged or removed. To prevent cache poisoning from happening in the first place, new integrity-checking technology like SRI can be used. Note: The illustration above is an example of DNS cache poisoning.

There are different approaches to cache poisoning. One method involves attacking the intermediate web cache by taking over the origin server temporarily, then serving compromised content marked to be cached for an extended period of time. The other method involves attacking the intermediate web cache server by disrupting the synchronization of the HTTP request and response streams between the origin server and the web cache. Here the attacker may use HTTP response splitting to pass the malicious content to the vulnerable web application, mostly through an HTTP request. The content is then included in an HTTP response header, usually sent to the user without validation. A typical approach to cache poisoning looks like this:

1. The attacker looks for, and exploits, flaws in the code, allowing them to place illegitimate headers in the HTTP header field
2. The attacker flushes out legitimate cached content from the cache server
3. The attacker sends a specially crafted request, or malicious data such as a forged DNS response, to the cache server
4. The illegitimate data is stored in the cache

An example is DNS cache poisoning where attackers replace a genuine IP address in the DNS cache with an IP address they control. Unaware of what has happened, users served from this DNS cache are redirected to the attacker’s compromised site. This may be a malware download site or one designed to collect sensitive personal data. In 2013, the Malaysian Google domains google.my and google.com.my suffered a DNS cache poisoning attack. The attackers had replaced the real domain IPs with their own rogue IPs. Users who tried to access any of the Google domains were redirected to a web page with a message that stated the Pakistani hacking group was responsible for the attack. This attack lasted for several hours until the security team from MYNIC, Malaysia's web addresses administrator, removed the rogue IP entries in the DNS cache.

Cache poisoning makes websites unusable and causes users to lose trust in the business. Therefore it’s critical to ensure all the cached content is valid and useful to the user. Among commonly-used methods for preventing cache poisoning is adding security to the DNS using tools such as DNSSEC. Other preventive measures include limiting the recursive queries to the DNS, and ensuring that only the data related to the requested domain is stored and sent to users.

As always, If you have any questions or concerns about any of the topics mentioned in this article, please feel free to reach out to support. Live chat and ticket support are available 24/7.