JIGGLE Attack: What Malformed Queries Reveal About DNS Resolver Security

Yuqi Qiu presents QuerySynth, an LLM-guided framework for generating malformed DNS queries from protocol specifications to identify security vulnerabilities in recursive resolvers and forwarders. Testing across major DNS implementations revealed inconsistent query handling that enables the newly identified JIGGLE Attack, including denial-of-service amplification, covert communication channels, and increased exposure to cache poisoning. A large-scale study of over 1.3 million open resolvers found that 70.33% exhibited at least one JIGGLE-related behavior. The talk discusses responsible disclosure, fixes released by DNS software vendors, and practical recommendations for improving resolver security.