Poster: Mind the Gap -- Characterizing the Temporal Blind Spot Between GSB and DNS Resolution

Technical Summary: Characterizing the Temporal Blind Spot Between GSB and DNS Resolution

Problem Statement
Modern web navigation relies on the concurrent execution of browser-level safety checks, specifically Google Safe Browsing (GSB), and Domain Name System (DNS) resolution. While GSB identifies potentially malicious resources and DNS maps domains to network destinations, their packet-level synchronization remains understudied. This is particularly relevant in complex scenarios involving Canonical Name (CNAME) chains, where multiple DNS steps are required to obtain a final address. The core problem addressed is whether a measurable temporal gap exists between the closure of GSB-related queries and the arrival of final DNS responses. If such a gap exists, it could create a "temporal blind spot" where a browser makes a safety decision before the final network endpoint is fully established, potentially exposing the system to DNS-manipulation threats (e.g., cache poisoning or resolver manipulation) that alter the endpoint after the safety check has completed.

Methodology
The authors employed a packet-capture analysis approach to characterize the timing relationship between GSB events and DNS resolution.

• Metric Definition: The study defines a timing gap ($\Delta time$) as the difference between the final DNS response arrival ($T_{resolution}$) and the transport-layer closure of the GSB-related connection ($T_{query\_close}$). A positive $\Delta time$ indicates that the DNS response arrives after the GSB query has closed.
• Data Extraction: GSB traffic was identified via TLS Server Name Indication (SNI) metadata. Since application data is encrypted, $T_{query\_close}$ was determined by the timestamp of the associated TCP FIN or RST packet. For CNAME-based resolutions, $T_{resolution}$ was recorded from the packet containing the final A or AAAA record.
• Experimental Setup: Experiments were conducted on a macOS workstation using Google Chrome Stable. To minimize caching effects, the system-level DNS cache and browser state were cleared before each navigation. A Node.js framework coordinated browser automation and packet capture (using Tshark) across two datasets derived from the Tranco rank:
  1. General Domains: The top 100 most popular domains.
  2. CNAME Domains: 103 high-ranked domains explicitly requiring CNAME resolution.

Key Results
The empirical analysis revealed a consistent temporal offset between GSB query closures and DNS responses:

• Prevalence: Positive timing gaps were observed in approximately 78% of the general-domain dataset (78 out of 100 samples) and 79.6% of the CNAME-domain dataset (82 out of 103 samples).
• Magnitude:
  • Median Delays: The median delay was 79.40 ms for general domains and 67.88 ms for CNAME domains.
  • Maximum Delays: The maximum observed gaps significantly exceeded the median, reaching 2,349.54 ms for general domains and 2,477.32 ms for CNAME domains.
  • Representative Data: Specific domains showed varying gaps, with facebook.com at 45 ms and amazonaws.com at 1,034 ms.
• Consistency: The results indicate that while many gaps are under 100 ms, the existence of a "long-tail" of delays exceeding two seconds is a recurring feature of the browsing workflow.

Significance and Claims
The paper modestly claims that these findings identify a security-relevant timing precondition rather than a complete browser bypass.

• Threat Model: Under a threat model where an adversary can influence DNS resolution (e.g., via cache poisoning or on-path manipulation), the observed timing gaps suggest a window where the final resolved endpoint could be altered after the Safe Browsing check has completed.
• Implication: This creates a potential mismatch between the browser's safety decision and the actual network endpoint. The authors argue that this temporal desynchronization, particularly in complex CNAME resolutions, warrants further research into timing-based risks.
• Future Directions: The paper suggests that future work should explore controlled DNS-manipulation scenarios to determine if these gaps can be exploited into practical end-to-end attacks. It also proposes investigating browser-side mitigations, such as binding safety decisions to the final resolved DNS endpoint or triggering revalidation when DNS resolution completes post-check.

In summary, the study provides a foundational packet-level characterization of the desynchronization between GSB and DNS, highlighting a measurable and frequent temporal window that may be relevant to browser safety mechanisms under specific threat models.