Blog | KOR Labs

Intercept and Inject: DNS Response Manipulation in the Wild

Manipulation Research April 07, 2023

6 min read

Intercept and Inject: DNS Response Manipulation in the Wild

In November 2021, Internet users from Mexico lost access to whatsapp.net and facebook.com. Here, we present key takeaways from our analysis of the event - carried out with RIPE Atlas - and we look at the extent to which queries to DNS root servers get manipulated.

Measuring DNS Abuse: Our first report

In May 2022, we wrote about kicking off our work to measure DNS Abuse. We are proud to announce today that we have launched our first report and gone live with our measurement initiative: DNSAI Intelligence.

Are you filtering for inbound spoofed packets? Chances are you're not

Source Address Validation (SAV) is the best current practice (BCP 38 / RFC 2827) aimed at filtering packets based on source IP addresses at the network edge. In this article, we show how to identify networks that do not deploy SAV for incoming traffic.