DNS Cache Snooping for Player Geolocation Risks

Abstract

The rapid expansion of the online gaming sector has heightened concerns regarding player privacy and security, particularly regarding geolocation tracking. While conventional geolocation methodologies typically depend on IP-based tracking, a less frequently addressed but comparably effective technique is DNS cache snooping. This method involves an attacker querying a recursive DNS resolver to ascertain whether a specific domain has been recently accessed by another user. By exploiting open resolvers and scrutinizing cached responses, malicious entities can deduce the existence of certain DNS queries emanating from a particular geographic locale, enabling them to approximate the physical location of players. This paper investigates the ramifications of DNS cache snooping for geolocation tracking within online gaming. We analyze how adversaries can capitalize on DNS caching behaviors to surveil players, assess the associated risks of this method, and evaluate its precision relative to traditional geolocation techniques. Through experimental case studies, we illustrate how attackers can utilize open DNS resolvers to extract geolocation insights, potentially subjecting players to privacy vulnerabilities, targeted cyberattacks, and disproportionate competitive advantages in online gaming environments. Moreover, we propose effective countermeasures to mitigate the threats posed by DNS cache snooping. These strategies include limiting access to open resolvers, implementing DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT), applying rate limiting to recursive resolvers, and endorsing the use of privacy-centric DNS services. Our findings emphasize the importance for gaming companies, internet service providers (ISPs), and security researchers to acknowledge DNS cache snooping as a legitimate threat to player geolocation privacy. By increasing awareness and advocating for more robust DNS practices, we aim to cultivate a gaming ecosystem that respects player privacy and safeguards their locations from unauthorized inference.