DNS Attack Writer a Victim of His Own Creation

BobB writes "HD Moore has been owned. Moore, the creator of the popular Metasploit hacking toolkit, has become the victim of a computer attack. It happened on Tuesday morning, when Moore's company, BreakingPoint, had some of its Internet traffic redirected to a fake Google page that was being run by a scammer. According to Moore, the hacker was able to do this by launching what's known as a cache poisoning attack on a DNS server on AT&T's network that was serving the Austin, Texas, area. One of BreakingPoint's servers was forwarding DNS (Domain Name System) traffic to the AT&T server, so when it was compromised, so was HD Moore's company."

Did he take it well?

[CaptSaltyJack (1275472)]

I wonder if, when he got attacked, he just leaned back in his big leather chair, and chuckled, "Well played, sir, well played."

Re:Did he take it well?

[capt.Hij (318203)]

According to the article (you know the one that is linked above) he said this:

Now he's one of the first victims of such an attack. "It's funny," he said. "I got owned."

Re:

[im_rotting (543266)]

Why read the article when there's a 'first post' to be had. :/

Moderators need moderating

[EdIII (1114411)]

I am usually not surprised when I get one incorrect moderation, but two different moderations that are wholly unwarranted demanded that I at least attempt to defend myself against the ignorant. A claim of ignorance is by no means an insult. It specifically means that the moderators lack the proper knowledge and experience to moderate.

First some background:

Flamebait is a message posted to a public Internet discussion group, such as a forum, newsgroup or mailing list, with the intent of provoking an angry r

Re:Did he take it well?

[pandrijeczko (588093)]

You're forgetting - he is one of these emotional American types rather than a stiff-upper-lipped Brit like myself.

In all likelihood, he probably bawled out a John McEnroe-like "YOU CANNOT BE SERIOUS!!!" and threw his mouse at his computer screen.

Re:Did he take it well?

[clone53421 (1310749)]

I can't decide whether to be offended or just laugh...

Re:Did he take it well?

[mbeans (1082073)]

Being called emotional by a Brit just means you have a pulse :)

Re:Did he take it well?

[MrNaz (730548)]

Not true. I heard that a stand up comedian in London died on stage, and nobody noticed until the corpse went cold.

Re:Did he take it well?

[rkww (675767)]

Not true. I heard that a stand up comedian in London died on stage, and nobody noticed until the corpse went cold.

True - it was Tommy Cooper [independent.co.uk]

In 1984, once again in a packed London theatre, the big man clutched his chest and slumped to the floor, his trademark red fez clinging precariously to his outsize head. The audience, millions watching live on television at home and more than 1,000 packed into Her Majesty'sTheatre, roared their approval - thinking it was part of the act.

But the sound of the comedian gasping for breath, hauntingly amplified by his radio microphone, slowly stifled the laughter, as the crumpled clown fell grotesquely against the curtain.

Re:

[LWATCDR (28044)]

I don't know but the cultural differences are amusing. I got to take some clients out for dinner. We took them to a Mexican restaurant and they started to eat the appraisers with a knife and fork.
Well politely told them that traditionally you ate them with your fingers.
He smiled and said, "Where British, we will never eat anything with our fingers with out being instructed first."
He was also shocked that I liked a lot of British TV shows. He thought that Americans didn't get sarcasm.
Over all very nice peopl

Re:Did he take it well?

[morgan_greywolf (835522)]

You're forgetting - he is one of these emotional American types

Wait! Are you saying that Americans are emotional! WTF, man! We are not fscking emotional!!! Gods, those Brits make me MAD AS HELL!! And I'm NOT going to take it anymore!!!

Re:Did he take it well?

[omnipresentbob (858376)]

I know! Let's go throw so freaking tea in the ocean. We'll show them!

Re:

[Midnight Thunder (17205)]

I know! Let's go throw so freaking tea in the ocean. We'll show them!

Jolly good show.

Re:Did he take it well?

[Kamineko (851857)]

http://www.dickensfair.com/images/costume_m1.jpg [dickensfair.com]

"Gentlemen, we're receiving this morning's stock broadcast on the ticker machine."

"What! Our stock values are tumbling! What the devil is going on, Mr. Smith?"

"Why, I believe some monstrous rascal has been at our wires! I do believe we've been owned, Mr. Jones."

Re:

[Saint Stephen (19450)]

Like Naomi Campbell?

Re:Did he take it well?

[Kingrames (858416)]

you forgot, "as he pet his white cat and the satellite dish that made up 90% of his secret lair exploded around him."

Re:Did he take it well?

[illumin8 (148082)]

I wonder if, when he got attacked, he just leaned back in his big leather chair, and chuckled, "Well played, sir, well played."

I'm tagging this article "irony" because it is the very definition of the word...

Re:

[encoderer (1060616)]

...?

well?

WHAT word?

Don't leave me hanging like this!

Karma

[Republican Gun (1174953)]

Proof that Karma is real baby!

Correction to the article published

[by Anonymous Coward]

The reporter has published a correction [pcworld.com], which is also reflected on the Metasploit Blog [metasploit.com].

at&t not him

[nicolas.kassis (875270)]

Well, all I can say is, no one, not even him can prevent this shit from happening if a server out of their control such as this is unpatched. He should give at&t hell. All the other big ones like comcast and verizon claim to be fully patched. I understand the size of at&t's network but this is no excuse when everyone uses your network and pays good money for it.

Re:at&t not him

[duplicate-nickname (87112)]

Well, you can choose to not use caching servers that are still vulnerable.

Re:

[SydShamino (547793)]

Forget this Moore guy. I don't care about him. What about the compromised AT&T DNS server?? I live in the Austin area and I logged into Paypal yesterday morning (ugh, I know) from home on our AT&T DSL. Was that DNS entry compromised? Do I need to take action?

Why was a legitimate news story turned into a social piece?

Good

[DaveV1.0 (203135)]

Serves him right.

Re:Good

[Kadin2048 (468275)]

Not sure why it would; he wasn't doing anything wrong. That's the funny thing about DNS poisoning -- you can be following best-practices to the letter, but if your ISP is sloppy, you'll get hit by it just the same.

AT&T are the ones to blame, if blame needs to be assigned.

Re:Good

[jimwelch (309748)]

Why does it server him right? (/pun)
He handled the flaw correctly.
  A) Find flaw
  B) Notify privately those affected.
  C) Give normal amount of time to fix.
  D) Notify public to force ISP's to DO THEIR JOB.

Or are you on the side of total secrecy of flaws. (CYA?)

Re:Good

[rfunk (765049)]

Er, this isn't the same guy who discovered the DNS flaw.

Re:Good

[AP31R0N (723649)]

If what you say is the case, and i don't know either way, then it might be like the word Draconian. Draco lived in a time where there were kings making up laws on the fly and inconsistently. He decided to write down these laws so folks could see them. Many of these laws were harsh, trivial or otherwise absurd. Somehow people decided to lay blame on Draco. So we call complex/harsh laws/rules Draconian.

Any history geeks on hand?

you know how the saying goes..

[pak9rabid (1011935)]

what goes around, comes around.

Along with everyone else in Austin

[zoward (188110)]

Since the attack wasn't on BreakingPoint, but rather than upstream DNS server, he pretty much just got swept up in the dragnet. These kind of attacks seem scarier than a direct attack, since you can do "everything right" with regard to patching, updating, firewalling, etc, and still get owned.

Re:

[Yvanhoe (564877)]

Define "owned".
Agreed, Google searches and DNS queries can be a pretty confidential information you wouldn't want to see made public, but it is not like the company was in any way hacked. If everything is set correctly, the man in the middle will not be able to see their encrypted webmail/mail traffic nor their financial communications. HTTPS has been developped with exactly this kind of attacks in mind.

Retraction Posted

[mubix (901806)]

http://www.pcworld.com/businesscenter/article/149136/dns_attack_writer_a_victim_of_his_own_creation.html [pcworld.com]

Re:Retraction Posted

[IBBoard (1128019)]

Not so much a retraction, more a correction. The company were still a victim of the cache poisoning, it has just been made clear that they were a victim along with everyone else in Austin.

Take note

[Daimanta (1140543)]

This is real irony. So, if someone tags this story "irony", he would be correct.

Re:Take note

[Freeside1 (1140901)]

yeah, it's kinda like a red light when you're already late.

In the words of the Bard ...

[r00tus3r (1185395)]

For tis the sport to have the engineer hoist with his own petard.

Re:In the words of the Bard ...

[MyLongNickName (822545)]

For tis the sport to have the engineer hoist with his owne petard.

Fixed it for you.

-- Old English Grammar Nazi

Re:In the words of the Bard ...

[by Anonymous Coward]

For tis the sport to have the engineer hoist with his owne petard.

Fixed it for you.

-- Olde English Grammar Nazi

Fixed it for thou.

Fixed it for thou.

Re:In the words of the Bard ...

[by Anonymous Coward]

For tis the sport to have the engineer hoist with his owne petard.

Fixed it for you.

-- Olde English Grammar Nazi

Fixed it for thou.

Fixed it for thee.

Fixed it for thee.

Re:

[mortonda (5175)]

For tis the sport to have the engineer hoist with his owne petard.

Fixed it for you.

-- Olde English Grammar Nazi

Fixed it for thou.

Fixed it for thee.

Thou needest to learn thine conjugation [wikipedia.org] when thou useth an objective noun... eth.

I think I got something stuck in my teeth.

DNS cache poisoning in the wild

[GogglesPisano (199483)]

It's interesting to see how widespread this exploit has become. I've checked my home and office connections using Dan Kaminsky's handy DNS Checker [doxpara.com] and it appears that my ISPs have taken measures to avoid this problem.

Unfortunately, I also travel a good deal for work, and it's hard to be sure that the ISP used by whatever-hotel-I'm-staying-at-this-week will be as proactive.

The guys in TFA got pwned by being redirected to a bogus Google look-alike page. As I understand it, this kind of attack would be noticeable when attempting to use a secure (HTTPS) web connection, because the browser should throw up a certificate error. Is this true? What other ways might be used to detect this problem?

Re:DNS cache poisoning in the wild

[Phroggy (441)]

As I understand it, this kind of attack would be noticeable when attempting to use a secure (HTTPS) web connection, because the browser should throw up a certificate error. Is this true?

Yes, this is true. HTTPS connections require an SSL certificate which must be signed by a Certificate Authority (CA) that your browser trusts. Your browser ships with a database of CA certificates, and you can manually add your own if you want; any SSL cert signed by one of those CAs will be trusted, but any SSL cert signed by anybody else will display a warning message before allowing you to access the web site.

Unfortunately, there are legitimate HTTPS sites out there using self-signed SSL certificates. Chances are, you've probably seen one at some point, and you went ahead and accepted it anyway, because you figured the company is legitimate and they just skimped on getting an SSL cert signed by a real CA. I know I have. If DNS cache poisoning (or other techniques) can get your browser to think it's talking to a particular host when it really isn't, AND you accept an invalid SSL certificate, you're screwed.

Note that SSL serves two purposes: it encrypts data while it's being sent over the wire so nobody* can eavesdrop on the connection between your browser and the server, and it also provides authentication so you can be sure that your browser is really talking to the server it thinks it's talking to. Using a self-signed certificate (or a certificate signed by an untrusted CA) renders the second of these useless, but the data is still encrypted.

* And of course when I said "nobody"... There is a way to intercept SSL connections, but it requires that you install a special CA cert in your browser, which will make your browser trust whoever is intercepting the SSL connections. This makes it possible to set up a caching proxy server that can inspect and cache data being sent over HTTPS. This is crazy stuff you shouldn't think about.

Re:

[profplump (309017)]

Self-signed certificates (or more generally, certificates from a CA you don't already trust) are only vulnerable the very first time you see them -- after that you can certainly detect changes.

But generally speaking, if you're worried about identifying a remote entity and not just encrypting traffic, you *must* at some point transmit verification information out-of-band and trust the integrity of that transmission. Pre-installed CA certificates are one way to do this, but certainly not the only way, and pro

Better checker is dnsentropy.

[Swordfish (86310)]

This DNS test is much better. https://www.dns-oarc.net/oarc/services/dnsentropy [dns-oarc.net]

Owned

[Stooshie (993666)]

In Soviet Russia your hacking toolkit owns you.

DNS should not be a vulnerability

[joekrahn (544037)]

The problem is that bad DNS responses should not be a source of vulnerability. Anytime there is traffic outside of your trusted domain, the identity of the remote system should not be trusted without a secure connection. There is work on Secure DNS, but I think it is better just to consider DNS unreliable, especially since wireless access points are common, and can give you whatever DNS they want. Even if you use another DNS server, it is easy enough to override it at the router. Unencrypted traffic should always be considered untrusted and prone to hacking. We need a system of secondary (tertiary, etc?) certificate signing so that every web site doesn't have to pay for a commercially signed certificate. That is more efficient and reliable than Secure DNS. (Right?)

Re:Dutch sayings rule

[by Anonymous Coward]

Really this proverb is best portrayed by the timeless coyote chasing the road runner cartoons.

Re:

[Emb3rz (1210286)]

Saying #1: Jesus to Peter after Peter had sliced the ear off of the slave Malchus.

Saying #2: ????

Saying #3: Galatians 6:7... though I was really tempted to say PROFIT!!!

Re:BEHOLD

[by Anonymous Coward]

Yeah.. it'd be more like the US getting attacked by weapons they made and sold to Iraq or something... oh hang on..

Re:I would post a comment...

[pseudorand (603231)]

Well, if all the posts are filled with mindless, off-topic dribble about how, in Soviet Russia, we welcome the opportunity exploit Natalie Portman's hot grit-pouring overlords with our vulnerable DNS servers, then it's a safe bet your on slashdot.