Slashdot Log In
DNS Attack Writer a Victim of His Own Creation
Posted by
CmdrTaco
on Wed Jul 30, 2008 09:21 AM
from the what-goes-around dept.
from the what-goes-around dept.
BobB writes "HD Moore has been owned. Moore, the creator of the popular Metasploit hacking toolkit, has become the victim of a computer attack. It happened on Tuesday morning, when Moore's company, BreakingPoint, had some of its Internet traffic redirected to a fake Google page that was being run by a scammer. According to Moore, the hacker was able to do this by launching what's known as a cache poisoning attack on a DNS server on AT&T's network that was serving the Austin, Texas, area. One of BreakingPoint's servers was forwarding DNS (Domain Name System) traffic to the AT&T server, so when it was compromised, so was HD Moore's company."
Related Stories
Submission: DNS attack writer a victim of his own creation by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Did he take it well? (Score:5, Funny)
Re:Did he take it well? (Score:5, Informative)
According to the article (you know the one that is linked above) he said this:
Parent
Re: (Score:3, Funny)
Moderators need moderating (Score:3)
I am usually not surprised when I get one incorrect moderation, but two different moderations that are wholly unwarranted demanded that I at least attempt to defend myself against the ignorant. A claim of ignorance is by no means an insult. It specifically means that the moderators lack the proper knowledge and experience to moderate.
First some background:
Re:Did he take it well? (Score:5, Funny)
You're forgetting - he is one of these emotional American types rather than a stiff-upper-lipped Brit like myself.
In all likelihood, he probably bawled out a John McEnroe-like "YOU CANNOT BE SERIOUS!!!" and threw his mouse at his computer screen.
Parent
Re:Did he take it well? (Score:4, Funny)
I can't decide whether to be offended or just laugh...
Parent
Re:Did he take it well? (Score:5, Insightful)
Being called emotional by a Brit just means you have a pulse :)
Parent
Re:Did he take it well? (Score:5, Funny)
Not true. I heard that a stand up comedian in London died on stage, and nobody noticed until the corpse went cold.
Parent
Re:Did he take it well? (Score:4, Informative)
Not true. I heard that a stand up comedian in London died on stage, and nobody noticed until the corpse went cold.
True - it was Tommy Cooper [independent.co.uk]
In 1984, once again in a packed London theatre, the big man clutched his chest and slumped to the floor, his trademark red fez clinging precariously to his outsize head. The audience, millions watching live on television at home and more than 1,000 packed into Her Majesty'sTheatre, roared their approval - thinking it was part of the act.
But the sound of the comedian gasping for breath, hauntingly amplified by his radio microphone, slowly stifled the laughter, as the crumpled clown fell grotesquely against the curtain.
Parent
Re: (Score:3, Interesting)
I don't know but the cultural differences are amusing. I got to take some clients out for dinner. We took them to a Mexican restaurant and they started to eat the appraisers with a knife and fork.
Well politely told them that traditionally you ate them with your fingers.
He smiled and said, "Where British, we will never eat anything with our fingers with out being instructed first."
He was also shocked that I liked a lot of British TV shows. He thought that Americans didn't get sarcasm.
Over all very nice peopl
Re:Did he take it well? (Score:5, Funny)
You're forgetting - he is one of these emotional American types
Wait! Are you saying that Americans are emotional! WTF, man! We are not fscking emotional!!! Gods, those Brits make me MAD AS HELL!! And I'm NOT going to take it anymore!!!
Parent
Re:Did he take it well? (Score:5, Funny)
I know! Let's go throw so freaking tea in the ocean. We'll show them!
Parent
Re: (Score:3, Funny)
I know! Let's go throw so freaking tea in the ocean. We'll show them!
Jolly good show.
Re:Did he take it well? (Score:5, Funny)
"Gentlemen, we're receiving this morning's stock broadcast on the ticker machine."
"What! Our stock values are tumbling! What the devil is going on, Mr. Smith?"
"Why, I believe some monstrous rascal has been at our wires! I do believe we've been owned, Mr. Jones."
Parent
Re: (Score:3, Funny)
Like Naomi Campbell?
Re:Did he take it well? (Score:4, Funny)
you forgot, "as he pet his white cat and the satellite dish that made up 90% of his secret lair exploded around him."
Parent
Re:Did he take it well? (Score:4, Funny)
I'm tagging this article "irony" because it is the very definition of the word...
Parent
Re: (Score:3, Funny)
...?
well?
WHAT word?
Don't leave me hanging like this!
Karma (Score:2, Funny)
Correction to the article published (Score:5, Informative)
The reporter has published a correction [pcworld.com], which is also reflected on the Metasploit Blog [metasploit.com].
at&t not him (Score:5, Insightful)
Re:at&t not him (Score:5, Insightful)
Well, you can choose to not use caching servers that are still vulnerable.
Parent
Re: (Score:3, Insightful)
Forget this Moore guy. I don't care about him. What about the compromised AT&T DNS server?? I live in the Austin area and I logged into Paypal yesterday morning (ugh, I know) from home on our AT&T DSL. Was that DNS entry compromised? Do I need to take action?
Why was a legitimate news story turned into a social piece?
Good (Score:4, Funny)
Serves him right.
Re:Good (Score:5, Insightful)
Not sure why it would; he wasn't doing anything wrong. That's the funny thing about DNS poisoning -- you can be following best-practices to the letter, but if your ISP is sloppy, you'll get hit by it just the same.
AT&T are the ones to blame, if blame needs to be assigned.
Parent
Re:Good (Score:5, Insightful)
Why does it server him right? (/pun)
He handled the flaw correctly.
A) Find flaw
B) Notify privately those affected.
C) Give normal amount of time to fix.
D) Notify public to force ISP's to DO THEIR JOB.
Or are you on the side of total secrecy of flaws. (CYA?)
Parent
Re:Good (Score:5, Informative)
Er, this isn't the same guy who discovered the DNS flaw.
Parent
Re:Good (Score:4, Interesting)
If what you say is the case, and i don't know either way, then it might be like the word Draconian. Draco lived in a time where there were kings making up laws on the fly and inconsistently. He decided to write down these laws so folks could see them. Many of these laws were harsh, trivial or otherwise absurd. Somehow people decided to lay blame on Draco. So we call complex/harsh laws/rules Draconian.
Any history geeks on hand?
Parent
you know how the saying goes.. (Score:3, Insightful)
Along with everyone else in Austin (Score:5, Informative)
Since the attack wasn't on BreakingPoint, but rather than upstream DNS server, he pretty much just got swept up in the dragnet. These kind of attacks seem scarier than a direct attack, since you can do "everything right" with regard to patching, updating, firewalling, etc, and still get owned.
Re: (Score:3, Insightful)
Agreed, Google searches and DNS queries can be a pretty confidential information you wouldn't want to see made public, but it is not like the company was in any way hacked. If everything is set correctly, the man in the middle will not be able to see their encrypted webmail/mail traffic nor their financial communications. HTTPS has been developped with exactly this kind of attacks in mind.
Retraction Posted (Score:5, Informative)
Re:Retraction Posted (Score:5, Informative)
Not so much a retraction, more a correction. The company were still a victim of the cache poisoning, it has just been made clear that they were a victim along with everyone else in Austin.
Parent
Take note (Score:4, Insightful)
This is real irony. So, if someone tags this story "irony", he would be correct.
Re:Take note (Score:5, Funny)
Parent
In the words of the Bard ... (Score:5, Funny)
Re:In the words of the Bard ... (Score:5, Funny)
For tis the sport to have the engineer hoist with his owne petard.
Fixed it for you.
-- Old English Grammar Nazi
Parent
Re:In the words of the Bard ... (Score:4, Funny)
For tis the sport to have the engineer hoist with his owne petard.
Fixed it for you.
-- Olde English Grammar Nazi
Fixed it for thou.
Fixed it for thou.
Parent
Re:In the words of the Bard ... (Score:5, Funny)
For tis the sport to have the engineer hoist with his owne petard.
Fixed it for you.
-- Olde English Grammar Nazi
Fixed it for thou.
Fixed it for thee.
Fixed it for thee.
Parent
Re: (Score:3, Informative)
For tis the sport to have the engineer hoist with his owne petard.
Fixed it for you.
-- Olde English Grammar Nazi
Fixed it for thou.
Fixed it for thee.
Thou needest to learn thine conjugation [wikipedia.org] when thou useth an objective noun... eth.
I think I got something stuck in my teeth.
DNS cache poisoning in the wild (Score:5, Interesting)
It's interesting to see how widespread this exploit has become. I've checked my home and office connections using Dan Kaminsky's handy DNS Checker [doxpara.com] and it appears that my ISPs have taken measures to avoid this problem.
Unfortunately, I also travel a good deal for work, and it's hard to be sure that the ISP used by whatever-hotel-I'm-staying-at-this-week will be as proactive.
The guys in TFA got pwned by being redirected to a bogus Google look-alike page. As I understand it, this kind of attack would be noticeable when attempting to use a secure (HTTPS) web connection, because the browser should throw up a certificate error. Is this true? What other ways might be used to detect this problem?
Re:DNS cache poisoning in the wild (Score:5, Informative)
As I understand it, this kind of attack would be noticeable when attempting to use a secure (HTTPS) web connection, because the browser should throw up a certificate error. Is this true?
Yes, this is true. HTTPS connections require an SSL certificate which must be signed by a Certificate Authority (CA) that your browser trusts. Your browser ships with a database of CA certificates, and you can manually add your own if you want; any SSL cert signed by one of those CAs will be trusted, but any SSL cert signed by anybody else will display a warning message before allowing you to access the web site.
Unfortunately, there are legitimate HTTPS sites out there using self-signed SSL certificates. Chances are, you've probably seen one at some point, and you went ahead and accepted it anyway, because you figured the company is legitimate and they just skimped on getting an SSL cert signed by a real CA. I know I have. If DNS cache poisoning (or other techniques) can get your browser to think it's talking to a particular host when it really isn't, AND you accept an invalid SSL certificate, you're screwed.
Note that SSL serves two purposes: it encrypts data while it's being sent over the wire so nobody* can eavesdrop on the connection between your browser and the server, and it also provides authentication so you can be sure that your browser is really talking to the server it thinks it's talking to. Using a self-signed certificate (or a certificate signed by an untrusted CA) renders the second of these useless, but the data is still encrypted.
* And of course when I said "nobody"... There is a way to intercept SSL connections, but it requires that you install a special CA cert in your browser, which will make your browser trust whoever is intercepting the SSL connections. This makes it possible to set up a caching proxy server that can inspect and cache data being sent over HTTPS. This is crazy stuff you shouldn't think about.
Parent
Re: (Score:3, Informative)
Self-signed certificates (or more generally, certificates from a CA you don't already trust) are only vulnerable the very first time you see them -- after that you can certainly detect changes.
But generally speaking, if you're worried about identifying a remote entity and not just encrypting traffic, you *must* at some point transmit verification information out-of-band and trust the integrity of that transmission. Pre-installed CA certificates are one way to do this, but certainly not the only way, and pro
Better checker is dnsentropy. (Score:4, Informative)
Parent
Owned (Score:3, Funny)
DNS should not be a vulnerability (Score:4, Insightful)
Re:Dutch sayings rule (Score:4, Funny)
Really this proverb is best portrayed by the timeless coyote chasing the road runner cartoons.
Parent
Re: (Score:3, Funny)
Saying #1: Jesus to Peter after Peter had sliced the ear off of the slave Malchus.
Saying #2: ????
Saying #3: Galatians 6:7... though I was really tempted to say PROFIT!!!
Re:BEHOLD (Score:5, Funny)
Yeah.. it'd be more like the US getting attacked by weapons they made and sold to Iraq or something... oh hang on..
Parent
Re:I would post a comment... (Score:5, Funny)
Parent