DNS FLaRE: A Flush-Reload Attack on DNS Forwarders

Gilad Moav, Yehuda Afek, Anat Bremler-Barr, Amit Klein

34th USENIX Security Symposium · Day 1

In an era where digital footprints increasingly reveal personal information, the privacy of online browsing activity remains a critical concern. The paper "DNS FLaRE: A Flush-Reload Attack on DNS Forwarders" introduces a novel **DNS cache-based timing side-channel attack** that allows an attacker to accurately infer the specific times at which a user visits particular websites. Developed by researchers from Tel Aviv University and Hebrew University of Jerusalem, this sophisticated attack targets **DNS forwarders**, ubiquitous components of the DNS infrastructure found in most home routers and Linux systems (e.g., `dnsmasq` and `systemd-resolved`).

AI review

Solid academic security research that takes the classic Flush-Reload primitive and actually makes it work against DNS forwarder caches. The port 0 trick for isolating DNS resolution time is genuinely clever, and the household-level privacy implications are real. Not earth-shattering, but it's rigorous work that required actual engineering.