Domain Decoupling Attack: Exploiting the Validation Gap Between Protective DNS and Shared Edge Routing

• URL: http://arxiv.org/abs/2608.00643v1
• Date: Sat, 01 Aug 2026 12:56:28 GMT
• Title: Domain Decoupling Attack: Exploiting the Validation Gap Between Protective DNS and Shared Edge Routing
• Abstract summary: This paper presents the Domain Decoupling Attack (DDA), which resolves an allowed domain to obtain permission for a shared edge IP.<n> Measurements of 1,069,048 domains across six continents produce 18,025,068 successful probes and identify exposure rates of 95.8% overall.
• Score: 20.356300242503416
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Network attackers often conceal malicious communication within legitimate Internet traffic. Existing CDN-based evasion techniques rely on SNI--Host inconsistency, insufficient domain ownership verification, or provider-specific routing rewrites, which limit their applicability in modern CDN environments. We identify a validation gap in DNS-based authorization, where permission derived from an allowed domain applies to a shared IP and can be reused to reach another tenant in both CDN and non-CDN shared-hosting environments. This paper presents the Domain Decoupling Attack (DDA), which resolves an allowed domain to obtain permission for a shared edge IP and subsequently connects to the same address while presenting the hidden domain consistently in both TLS SNI and HTTP Host. Measurements of 1,069,048 domains across six continents produce 18,025,068 successful probes and identify exposure rates of 95.8% overall, 99.26% for CDN domains, 92.75% for non-CDN domains, and 97.7% for non-CDN cross-tenant IPs, while laboratory experiments reveal a structural limitation of DNS-bound access control on shared addresses. These results clarify the security risks of DNS-derived IP authorization and support the evaluation and improvement of access-control mechanisms in CDN and non-CDN shared-hosting environments.

Related papers

• Secrets Best Not Shared: DNS Privacy Enhancements for the Constrained IoT [2.3195032320229503]
  Attackers often identify DNS traffic to disrupt or compromise Internet services.<n>We consider IETF protocols designed for resource-constrained IoT devices.<n>We show that DNS over CoAP with equalized packet lengths, block-wise transfer, and header compression reduces the accuracy of identifying DNS frames to 86%.
  arXiv  Detail & Related papers  (2026-06-08T19:22:30Z)
• Overcoming DNSSEC Islands of Security: A TLS and IP-Based Certificate Solution [0.03262230127283452]
  We propose a decentralized approach to addressing gaps in DNSSEC's chain of trust.<n>We leverage TLS and IP-based certificates to enable end-to-end authentication between hierarchical levels.
  arXiv  Detail & Related papers  (2025-09-10T08:02:07Z)
• Detecting and Measuring Security Implications of Entangled Domain Verification in CDN [30.611196380526213]
  Absence of Domain Verification (DVA) is a significant security flaw in Content Delivery Networks (CDNs) We present DVAHunter, an automated system for detecting DVA vulnerabilities that can lead to domain abuse in CDNs.
  arXiv  Detail & Related papers  (2024-09-03T13:27:33Z)
• Say No to Freeloader: Protecting Intellectual Property of Your Deep Model [52.783709712318405]
  Compact Un-transferable Pyramid Isolation Domain (CUPI-Domain) serves as a barrier against illegal transfers from authorized to unauthorized domains. We propose CUPI-Domain generators, which select features from both authorized and CUPI-Domain as anchors. We provide two solutions for utilizing CUPI-Domain based on whether the unauthorized domain is known.
  arXiv  Detail & Related papers  (2024-08-23T15:34:33Z)
• Don't Get Hijacked: Prevalence, Mitigation, and Impact of Non-Secure DNS Dynamic Updates [1.135267457536642]
  DNS dynamic updates represent an inherently vulnerable mechanism. Non-secure DNS updates leave domains susceptible to a novel form of attack termed zone poisoning. We undertook a comprehensive campaign involving the notification of Computer Security Incident Response Teams.
  arXiv  Detail & Related papers  (2024-05-30T09:23:53Z)
• Measuring CDNs susceptible to Domain Fronting [2.609441136025819]
  Domain fronting is a network communication technique that involves leveraging content delivery networks (CDNs) to disguise the final destination of network packets. This technique can be used for both benign and malicious purposes, such as circumventing censorship or hiding malware-related communications from network security systems. We propose a systematic approach to discover CDNs that are still prone to domain fronting.
  arXiv  Detail & Related papers  (2023-10-27T02:04:19Z)
• Model Barrier: A Compact Un-Transferable Isolation Domain for Model Intellectual Property Protection [52.08301776698373]
  We propose a novel approach called Compact Un-Transferable Isolation Domain (CUTI-domain) CUTI-domain acts as a barrier to block illegal transfers from authorized to unauthorized domains. We show that CUTI-domain can be easily implemented as a plug-and-play module with different backbones.
  arXiv  Detail & Related papers  (2023-03-20T13:07:11Z)
• Domain-Agnostic Prior for Transfer Semantic Segmentation [197.9378107222422]
  Unsupervised domain adaptation (UDA) is an important topic in the computer vision community. We present a mechanism that regularizes cross-domain representation learning with a domain-agnostic prior (DAP) Our research reveals that UDA benefits much from better proxies, possibly from other data modalities.
  arXiv  Detail & Related papers  (2022-04-06T09:13:25Z)
• Bridging the Source-to-target Gap for Cross-domain Person Re-Identification with Intermediate Domains [63.23373987549485]
  Cross-domain person re-identification (re-ID) aims to transfer the identity-discriminative knowledge from the source to the target domain. We propose an Intermediate Domain Module (IDM) and a Mirrors Generation Module (MGM) IDM generates multiple intermediate domains by mixing the hidden-layer features from source and target domains. MGM is introduced by mapping the features into the IDM-generated intermediate domains without changing their original identity.
  arXiv  Detail & Related papers  (2022-03-03T12:44:56Z)
• Decompose to Adapt: Cross-domain Object Detection via Feature Disentanglement [79.2994130944482]
  We design a Domain Disentanglement Faster-RCNN (DDF) to eliminate the source-specific information in the features for detection task learning. Our DDF method facilitates the feature disentanglement at the global and local stages, with a Global Triplet Disentanglement (GTD) module and an Instance Similarity Disentanglement (ISD) module. By outperforming state-of-the-art methods on four benchmark UDA object detection tasks, our DDF method is demonstrated to be effective with wide applicability.
  arXiv  Detail & Related papers  (2022-01-06T05:43:01Z)
• IDM: An Intermediate Domain Module for Domain Adaptive Person Re-ID [58.46907388691056]
  We argue that the bridging between the source and target domains can be utilized to tackle the UDA re-ID task. We propose an Intermediate Domain Module (IDM) to generate intermediate domains' representations on-the-fly. Our proposed method outperforms the state-of-the-arts by a large margin in all the common UDA re-ID tasks.
  arXiv  Detail & Related papers  (2021-08-05T07:19:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.