Slashdot Log In
Patch DNS Servers Faster
Posted by
kdawson
on Fri Jul 25, 2008 09:41 AM
from the hard-times-coming dept.
from the hard-times-coming dept.
51mon writes "Austrian CERT used data from one of their authoritative DNS server to measure the rate at which the latest DNS patch (source port randomization) is being rolled out to larger recursive name servers. While about half the traffic (PDF) they receive is now using source port randomization, their data suggest that this is due to ISPs who roll out such fixes immediately. The rate of patching has fallen to disappointingly low levels since. If your ISP isn't patched, perhaps it is time to switch." After details of the DNS vulnerability leaked, researchers |)ruid and HD Moore released attack code; ZDNet's security blog has an analysis.
Related Stories
[+]
Massive, Coordinated Patch To the DNS Released 315 comments
tkrabec alerts us to a CERT advisory announcing a massive, multi-vendor DNS patch released today. Early this year, researcher Dan Kaminsky discovered a basic flaw in the DNS that could allow attackers easily to compromise any name server; it also affects clients. Kaminsky has been working in secret with a large group of vendors on a coordinated patch. Eighty-one vendors are listed in the CERT advisory (DOC). Here is the executive overview (PDF) to the CERT advisory — text reproduced at the link above. There's a podcast interview with Dan Kaminsky too. His site has a DNS checker tool on the top page. "The issue is extremely serious, and all name servers should be patched as soon as possible. Updates are also being released for a variety of other platforms since this is a problem with the DNS protocol itself, not a specific implementation. The good news is this is a really strange situation where the fix does not [immediately] reveal the vulnerability and reverse engineering isn't directly possible."
[+]
Kaminsky's DNS Attack Disclosed, Then Pulled 281 comments
An anonymous reader writes "Reverse engineering expert Halver Flake has recently mused on Dan Kaminsky's DNS vulnerability. Apparently his musings were close enough to the mark to cause one of the Matasano team, who apparently already knew of the attack, to publish the details on the Matasano blog in a post entitled 'Reliable DNS Forgery in 2008.' The blog post has since been pulled, but evidence of it exists on Google and elsewhere. It appears only a matter of time now before the full details leak."
Reader Time out contributes a link to coverage on ZDNet as well.
[+]
Attack Code Published For DNS Vulnerability 205 comments
get_Rootin writes "That didn't take long. ZDNet is reporting that HD Moore has released exploit code for Dan Kaminsky's DNS cache poisioning vulnerability into the point-and-click Metasploit attack tool. From the article: 'This exploit caches a single malicious host entry into the target nameserver. By causing the target nameserver to query for random hostnames at the target domain, the attacker can spoof a response to the target server including an answer for the query, an authority server record, and an additional record for that server, causing target nameserver to insert the additional record into the cache.' Here's our previous Slashdot coverage."
[+]
Apple Still Has Not Patched the DNS Hole 296 comments
Steve Shockley notes an article up at TidBITS on Apple's unexplained failure to patch the DNS vulnerability that we have been discussing for a few weeks now. "Apple uses the popular Internet Systems Consortium BIND DNS server, which was one of the first tools patched, but Apple has yet to include the fixed version in Mac OS X Server, despite being notified of vulnerability details early in the process and being informed of the coordinated patch release date."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Switch DNS Servers, NOT ISPs (Score:5, Insightful)
Re:Switch DNS Servers, NOT ISPs (Score:4, Interesting)
I ditched the phone company when my email didn't get a reply in a week.
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
And their ssl certificates are used between computers that need to communicate each others. If one doesn't get the update that the other has changed of certificate you can go in the wall. And If you have hundred, thousands of such computers that need to talk to each other, you can imagine the nightmare.
DNS became slower (Score:3, Interesting)
It seems that dns queries have become much slower. With opera I can see what urls are being requested (main page, images/flash or ads).I can see that for every new page the first thing opera does is doing the dns queries for all the urls. And this has become very slow from time to time.
I've read somewhere that the randomization really slows down bind, but that the team is working on a patch to solve that.
(I also don't understand why opera need to execute dns queri
Re: (Score:3, Interesting)
If it has become slower, they are probably using bind9, because it's quick fix. After they've known for 6 months, all they could release was a quick fix. Even though the author/organsation that created/maintainces bind knew about possible problems somewhere in the preview century. I'm sorry, but I've stopped using their software as much as possible.
Re:Switch DNS Servers, NOT ISPs (Score:5, Interesting)
I used OpenDNS and gave it up because it replaced firefox's feature to search google with what you type on the address bar with its own crappy search.
Parent
Re: (Score:3, Informative)
"404 error: File not found" is more useful then the OpenDNS search result page?
Yes, yes it is. Because many, many things depend on getting a proper 404 error, like all those http-download automatic updates for example.
Of course, it's not the 404 error that's missing. It's a name resolution failure. This is also very important. You need to know when a domain has gone missing, and it needs to be available in an automated fashion. The proper, per-specification behavior is to return NXDOMAIN when there is no domain found, not to return a bullshit, erroneous result.
This WOULD be LESS offen
Re:Switch DNS Servers, NOT ISPs (Score:5, Informative)
A DNS server returns you a result, or tells you that it can't resolve the domain. Instead of doing the latter, OpenDNS redirects you somewhere you didn't intend to go and attempts to hit you with some advertising. That seems more like typosquatting to me, although admittedly it's with your permission.
Parent
Re: (Score:2)
Re: (Score:2, Insightful)
OpenDNS is not the best answer (Score:2, Insightful)
Re: (Score:2)
>>You don't need to switch to a new ISP if they haven't patched yet - just switch to a new DNS server such as OpenDNS.
Is this really true?
From what I gather this doesn't solve the problem, just makes it a little more difficult. Correct me if my understanding is wrong.
Your router still uses default of 53 -> OpenDns -> public on random port.
UDP
You still listen on 53, so the hacker can spoof the response as though it's from OpenDNS's two IP's and send that straight to your router on port 53.
Am I w
Re: (Score:3, Informative)
You don't need to switch to a new ISP if they haven't patched yet - just switch to a new DNS server such as OpenDNS.
Please don't do that.
I don't think OpenDNS is a terribly good idea, and here's why:
They actively screw with the records and return incorrect information. Now you can argue that they do it for "OK" reasons, and indeed, OpenDNS does exactly this in their marketing materials, but the fact remains: they answer some queries with information that is in conflict with the authoritative nameservers.
Personally, I don't trust any DNS provider that does this, and I don't think it's a good idea for anyone to do so.
Use
Re: (Score:3, Informative)
It'll either be a setting on your router, or if your directly connected to the modem, you'll need to change it on the network settings on your computer.
Re:Switch DNS Servers, NOT ISPs (Score:5, Informative)
You can change this in your DHCP or IP configuration settings on your home router or PC. On my home network, for instance, my DD-WRT router isn't running a DNS server on it, and the DHCP static DNS settings are set for my Server 2008 box and the two OpenDNS resolvers. My Server 2008 box also has its forwarders set to OpenDNS.
That's probably more complicated than it needs to be, but better safe than sorry.
On Windows XP, 2000, and I think Vista, you can tell Windows to ignore the DNS server settings provided by DHCP by going into the IP properties for the connection and hard coding in the IP addresses under Local Area Connection Properties > Internet Protocol Properties > Use the Following DNS Server Addresses.
This can also be done under linux, but I don't know the particular commands for it.
Parent
Re:Switch DNS Servers, NOT ISPs (Score:5, Interesting)
I had been using OpenDNS. I stopped when I realized they were monitoring my traffic. When I go to Google, they were returning their own Google-like page, to which my browser would submit the query, and then redirect me to Google.
I stopped using them after that discovery.
Parent
Re: (Score:3, Informative)
I had been using OpenDNS. I stopped when I realized they were monitoring my traffic. When I go to Google, they were returning their own Google-like page, to which my browser would submit the query, and then redirect me to Google.
I stopped using them after that discovery.
Your claim that OpenDNS is "monitoring your traffic" is misleading.
If you ping www.google.com it pings google.navigation.opendns.com (208.67.219.231). You still get the standard Google homepage and search results when you go to http://www.google.com/ [google.com] however. The odd DNS resolution for www.google.com is apparently because some software such as the Google Toolbar bypasses DNS requests, which breaks some of OpenDNS's features. (More on this below.) One apparent advantage of OpenDNS doing this is that it help
Re: (Score:2)
Re: (Score:3, Informative)
I put OpenDNS right in my router configuration so it applies to my whole house. The other big benefit is that I block doubleclick whose ads always seem to make pages so slow to load. You also get some scam and phishing protection.
Re: (Score:2, Informative)
I have no idea what netconfig is meant to do, but it doesn't exist on my computer. /etc/resolv.conf is the standard way of doing it.
Re:Switch DNS Servers, NOT ISPs (Score:5, Informative)
resolv.conf will be written over by DHCP unless you set PEERDNS=no in the /etc/sysconfig/network-scripts/ifcfg-ethX file.
Parent
Monopoly (Score:5, Insightful)
My ISP has a monopoly over internet services in my area you insensitive clod.
Re: (Score:2, Funny)
Re: (Score:2)
Run your own then.
time to switch? (Score:4, Insightful)
If your ISP isn't patched, perhaps it is time to switch.
Thanks to the "free market economy" in my capitalist country I can't switch, you insensitive clod!
Re: (Score:2)
No. For many people its more a choice between "Evil ISP XYZ, and Pigeon over IP and/or dial up".
That said, my ISP enrolled me in a "contract" without ever once mentionning it. (It -is- optional, and I never said I wanted it when I subscribed, and I didn't sign anything, but my bill states that I picked the contract option). Kind of amusing.
I'm not saying anything now because it is cheaper, I don't care even if I -was- on contract, and they wouldn't last very long in court if I ever changed my mind, but...
AT&T Southeast way behind the curve (Score:3, Interesting)
We use AT&T (formerly Bellsouth) and their servers are not fixed according to the 'dig +short porttest.dns-oarc.net TXT' test.
I contacted their NOC about the problem yesterday and got the following reply:
"Patching for these servers are scheduled to begin next week."
So, major vulnerability, two weeks advance notice, exploit code released - we'll get around to it later.
Re: (Score:2)
Or immediately after att.com starts resolving to the IP of goatse.cx ?
ISP DNS (Score:2, Insightful)
Who uses their ISPs DNS servers? Most people probably. Well, I don't trust them. My friends and I run a recursing nameserver that we access over a VPN link.
ISPs just aren't trustworthy.
Oops. (Score:5, Funny)
Re: (Score:2)
For once, I can check how many people have really RTFA (or at least fetched the .pdf). :-)
I really didn't expect we'd make slashdot with that report. Well, any exposure help to get people to patch.
Re: (Score:2)
Easier Said Than Done (Score:5, Interesting)
These kind of systems are really hard for security guys to get changed.
It's like updating switch and routing firmware. Most network engineers who know what they're doing and that have been around for awhile have been burned by "simple" or "easy" patches and config changes going tits up.
When your core network infrastructure goes tits up your phone tends to light up like a christmas tree. (Granted, when your web presence is redirected to porn or a copy that hides an iframe exploiting customers with unpatched browsers, well, you'll maybe get some phone calls.)
This DNS patch is a case-in-point: Microsoft's fix is rather ham-fisted and broke stuff; the BIND-Users list is full of people troubleshooting ISC's patch.
Also, many organizations (like mine) are taking this as an opportunity to reengineer their DNS architecture. This is the perfect time to reevaluate using TSIG and DNSSEC if you don't already.
It has only been just over two weeks since the initial "announcement". The progress so far is really amazing when you consider how big a ship the Internet is.
Re: (Score:3, Informative)
It's a perfect time to start using PowerDNS, djbdns or Unbound/NSD as well. :-)
Re: (Score:3, Funny)
When your core network infrastructure goes tits up your phone tends to light up like a christmas tree.
Not if it is an IP phone!
Rediculious requirements (Score:5, Insightful)
I'll get this patch applied as soon as I reconfigure my entire network topology.
Re:Rediculious requirements (Score:5, Informative)
You can restrict it to a port range... even giving it access to 2048 ports gives you 2^11 randomness, which is still better than 2^0.
The issue I'm facing, which I find terribly frustrating, is in upgrading older distros. I'm now looking at completely reinstalling a bunch of older BSD servers just to get this idiotic vulnerability resolved, because the maintainers aren't backporting the patch and upgrading BIND itself would be a royal pain. Given how DNS servers tend to run unattended for eons, I suspect this near-sightedness is respnosible to a large degree for the slow patching. It's not that I don't want to patch my servers, it's that I now have to waste a day at the colo doing physical reinstalls. If it weren't for that hitch, I'd be done already!
Parent
Re:Rediculious requirements (Score:5, Funny)
That is not the case at all. First off, on outbound requests, the destination port is still 53. The _source_ port is what gets randomized. On inbound replies to the randomized port, your stateful firewall will see this as an ESTABLISHED connection and you can safely let it in without blindly opening up the entire UDP port space.
You _are_ running a stateful firewall, right? Its not 1998 anymore.
-molo
Parent
Re: (Score:2)
OpenSuSe 10.2 RPMs miss the point? (Score:3, Interesting)
I have an OpenSuSe 10.2 x86_64 machine and have manually upgrade-installed the x86_64 RPMs from the security announcement (http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00003.html [opensuse.org]). Yast2 has some problems due to this release being old and mirrors not available so I did a manual "rpm -Uhv".
Still, from a traffic dump it seems that on SuSe 10.2 the caching Bind nameserver sends out queries with predictable source ports (incrementing by 1).
Fedora's patched Bind sends from random ports (didn't run statistical randomness test on them, though).
Re:Am I safe? (Score:5, Informative)
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
https://www.dns-oarc.net/oarc/services/porttest [dns-oarc.net]
Re:Am I safe? (Score:5, Informative)
dig +short porttest.dns-oarc.net TXT
Parent
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Re: (Score:2)
Easiest is to temporarily put it in /etc/hosts.
Re: (Score:2)
Don't trust them if yours is behind a simple DSL-router with NAT. The NAT may defeat any randomisation you might have.