RaMOF: Ranking Manipulation Leveraging Open Forwarders

The utilization of top lists in Internet measurement, security analysis, and threat detection is pervasive within the Internet community. Nevertheless, traditional top lists have faced substantial criticism due to their susceptibility to ranking manipulation. Many efforts have been devoted to improving the manipulation resistance and stability of top lists, such as the passive DNS (pDNS)-based top list, Secrank, and the aggregated list, Tranco. However, it remains unexamined how robust these newly built top lists are against ranking manipulation. In this paper, we identified a systematical pitfall present in mainstream pDNS-based top lists and propose RaMOF, a novel Ranking Manipulation approach based on Open Forwarders, leveraging the inherent forwarding relationships between open forwarders and public DNS services. Our research reveals that not only all existing pDNS-based top lists, including Umbrella, Secrank, and Farsight, are susceptible to the RaMOF attacks, but also aggregated top lists, such as Tranco, are vulnerable to the RaMOF attack. In the end, we proposed a series of mitigation measures to empower the Internet community to enhance the quality and reliability of top lists.