Identity Theft Hits the Root Name Servers 131
aos101 writes "The Renesys blog has an interesting story about networks advertising the old address space of the L root name server after ICANN changed the IP address last November. These networks were also running root name servers on the old IP address of the L root name server up until last week, so any DNS servers still using the old IP address might have been getting their answers from these bogus name servers. A very cursory examination by Renesys of one of these bogus servers found that it appeared to be providing correct responses, which might be why no one noticed the problem. As Renesys points out, the volume of traffic to a root server is staggering, so the people running these bogus root servers must have had a reason. What did they get out of it?"
Good Samaritans? (Score:3, Insightful)
Re:Good Samaritans? (Score:4, Insightful)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
And, for that matter, if Bill Manning authorized the use of the address space, then it's not even an attack!
Re: (Score:2)
Re:Good Samaritans? (Score:5, Insightful)
The fact that those who did this had huge resources do not make it less scary, neither does the fact that nobody detected anything. Remeber how that guy operated a tor exit node to get a whole lot of interesting datas; the idea here is the same.
(A concrete example would be to send your wikipedia request to a bogus wikipedia website. It would forward all your queries to the real wikipedia, so you couldn't tell the difference (man in the middle), but on some pages it would serve you an altered page; it could also make you feel like you wrote an article, but the article would actually only show up on your copy of the bogus website, not the real one. Encryption twarts this, otherwise it's really the worst case scenario.)
And apparently, there is nothing to prevent it from happening again. Since people seem so little concerend, I must have missed some detail which makes everything fine; or at least I really hope so.
Re: (Score:2)
Also, an ISP from an other country will not be able to affect you; but that root server effect is world-wide.
Of course (IIRC), the US always had their hand on a server with that kind of privilege. But again, meddling with it would have directly incriminated the US.
trust (Score:2)
Re: (Score:2)
I could be wrong, but all DNS does is resolve a domain (e.g. en.wikipedia.org) to an IP address (e.g. 208.80.152.2). So they could redirect you to a completely different website, but not just a different page. Also, because of the way DNS data is usually cached all over the place, they would only see one request per domain during all of your browsing, if that.
But If ther send you to a bogus wikipedia IP, this one can in turn convert all your queries to wikipedia, except some that it meddle with (man in the middle attack). And you only need to highjack the name once (caching will cache the bogus IP).
Re:Good Samaritans? (Score:5, Interesting)
Later, my new boss wanted to switch to a Linux based system, instead of the windows system which I'd already repurposed. I quoted him a modest server, set it up as a secure proxy for some of our internal web applications, and let the original linux system keep chugging along.
I figure I can get at least two more servers out of this, before I actually have to upgrade the system.
Maybe the guys at root-servers just left some hardware running at the old address?
They should never have relinquished the address so damn quickly. Turn off the equipment for a few weeks first and let people see that that address no longer works...Don't just let someone move in seamlessly and hijack your junk.
Re:Good Samaritans? (Score:5, Insightful)
Re: (Score:3, Interesting)
Isn't there some sort of authentication for DNS a la SSL certificates? If not, would this take a major overhaul of the DNS system to support it?
As I understand it, there's also a man-in-the-middle type of attack with DNS where a local router (possibly a Hacked By Chinese(tm) "Cisco" router) will substitute its own DNS replies instead of passing the query to the real DNS server.
Couldn't both of these issues be resolved by having a field on the DNS record where the reply is signed by the DN
Re:Good Samaritans? (Score:5, Insightful)
Re: (Score:2)
Around the same time as L was moved, the Swedish ccTLD
to ICANN urging them to deploy DNSSEC and sign the root zone.
Hopefully this incident will speed things up.
Re: (Score:2)
Re: (Score:2)
Judging by the other replies to your post, it seems like there's some hope. Even if it was just
Re:Good Samaritans? (Score:5, Interesting)
Re: (Score:2, Insightful)
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Good Grief! (Score:2)
Re:Good Samaritans? (Score:5, Insightful)
Most people don't pay much attention to their DNS infrastructure. The stuff doesn't need much maintenance. If it breaks, they'll notice that something is wrong, but if it continues working seamlessly, they'll ignore it.
Re: (Score:2)
Granted, someone much bigger than me might notice that 8% of their queries are failing and being re-tried... But I don't know how long it would take before it happened...
Re: (Score:2)
Exactly what you'd want if you want people to be more aware of internet and dns problems.
Update those root zonefiles, people !
Re: (Score:3, Insightful)
If you follow the article the actual change of IP address doesn't even matter. The server change merely provided a situation where they weren't paying as much attention to the old DNS.
It sounds like the attack could be pulled off at any time vs
Yup. (Score:2)
I was redoing some DNS stuff earlier (switching out a server) and I had CNAME on the brain.
Sad that you're the only person who noticed =P
Re:Good Samaritans? (Score:5, Informative)
http://blog.icann.org/?p=227 [icann.org]
It is expected that the old address will continue to work for at least six months after the transition, but will ultimately be retired from service.
1st November 2007 -> 1st May 2008 is 6 months. So they left it a few days over 6 months
Tim.
Re: (Score:3, Informative)
Re:Good Samaritans? (Score:4, Insightful)
For the owner of the original IP address now being vacated by ICANN, there is also maybe a self-interest motive of identifying the servers who hadn't updated so as to notify them and kill the unwanted traffic.
Given how visible this is, it's hard to imagine anyone doing it for criminal purposes and thinking they could get away with it.
Re: (Score:2)
Re: (Score:2)
If they want to point to spammy sites, or collect dns typing mistakes then they are legal.
Re: (Score:1)
1) This is the (D)ARPANet... I'm sure the US government would not take kindly to spoofing a root level name server even if the mechanism by which it was done was legal
2) Never mind the military/government basis of the internet, knowingly messing with
Extremely vague article (Score:2, Informative)
"Hey, something happened. No, we don't know who, what, when, or why. We do know where, but that's it. You got any ideas?"
Should have been submitted as "Ask Slashdot"... Then maybe we might find out what happened, if anything. As is, it is a non-news item.
Re:Extremely vague article (Score:5, Informative)
icann hosted L-root on ip addresses they didn't have an exclusive right to use.
they decided to stop doing that and moved L-root to somewhere else.
shortly thereafter someone else decided to operate a name server on the very same IP addresses.
that's *what* happened. perhaps you meant to say that the article doesn't say *why* it happened. that would be a fair criticism.
Re: (Score:2)
Re:Extremely vague article (Score:4, Interesting)
you're missing something here. It wasn't just that "someone" else decided to operate a bogus L root server on that IP address, it's that several someones were doing this. The article states there were FOUR of these running on the OLD ip address. so you had the newly IP'd correct L server, and 4 bogus L servers (one of which was being run by ICANN itself), all using the same old IP address.
How could this happen you ask? because 3 entities not authorized to announce they host that IP block did so anyway, so there were 4 different routes to that IP block on the Internet, resulting in 4 possible places you could end up at when sending DNS queries to the old address, 198.32.64.12.
So basically there are 2 concerns here, one is that a couple of Internet entities were advertising routes for an IP block they were not authorized to advertise, and that they were running a bogus L root server from that IP block on it's old address. Bill Manning owned the IP block so his ISP was authorized to advertise that route, and it might be obvious why ICANN was also advertising a route for it as well (to try to get that traffic going to the old IP address for root lookups), but why were Community DNS and Diyixian.com advertising that route and running a bogus L root server?
Re: (Score:2)
Not entirely. It reminded me to update my root zone file on my DNS servers
Cashing In (Score:2, Insightful)
Re: (Score:3, Informative)
they may be gathering data from NX hits, though. who could say. well, community dns could say. perhaps they will.
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
What possible use could a list of mistaken TLDs be if these TLDs need to be approved by ICANN before they can be used?
statistics? profiling? (Score:3, Insightful)
that data would be worth something to ad men surely...
Re: (Score:2)
Re:statistics? profiling? (Score:5, Funny)
(flem, 'a', 'n'...)
What? (Score:5, Insightful)
How do we go from this to a headline reading Identity Theft Hits the Root Servers?
There is no reason to believe that it was malicious at all. We all are familiar with that black hat turned grey or white that wants to help out by demonstrating vulnerabilities in the system. That is just as plausible as anything else. Maybe it's the free-masons!! The Illumanati, maybe!!! The only certain thing about this is the need to secure name service. We should be glad even though it was compromised, there is no apparent damage done.
Re: (Score:1)
Either that, it was just some spammers trying to gather information. Nah, that's wayyyy too plausible.
Re: (Score:2)
Re: (Score:2, Insightful)
Media is biased, because humans are biased. No single political party is any more or less inclined to distort facts in-line with their own beliefs.
Would you have preferred a headline reading "Rogue DNS server running for 6 months with no adverse effects. Spread the lulz!" ?!
Harvesting NXDOMAIN hits (Score:5, Interesting)
Re:Harvesting NXDOMAIN hits (Score:5, Informative)
On the other hand, the person in control of the root could give bogus records for the name servers for something like com. This is unlikely to be a major problems since the TTL on all the records served by the root is 120 days. Most people are going to be querying a caching name server of some sort, so it's statistically unlikely to affect much of the population before it is detected and dealt with.
Not to plug my own work too much, but as a part of my research, I work with a team that monitors DNSSEC deployment. This is something we would in theory be able to see from our distributed polling framework, and our datasets going back to 2005 don't show anything like a rogue TLD server being published. Kind of unfortunate in a way, being that DNS isn't exactly the most interesting research topic at face value.
Re: (Score:2)
Re: (Score:2)
How great it would be to have a top level domain of
Collecting valid IP addresses, reference data (Score:2, Interesting)
What they got (Score:2)
Re:What they got (Score:5, Insightful)
Re: (Score:1, Redundant)
Could be several reasons (Score:5, Interesting)
A few reasons spring immediately to mind.
1. Preliminary move with the intent of actual subversion of results at a later date. This gives you an idea of what the traffic looks like, the volume you're going to have to manage, and the technical requirements of managing the subversion on top of recording important information about the systems you just subverted for later exploitation, plus any statistical information you need/want to improve your subversion process.
2. Preliminary move by a government, corporate entity, or some grouping with the intent of either wresting control of some portion of the DNS infrastructure from ICANN, or setting up a country-specific DNS infrastructure that is legally mandated. Again, you get valuable information about the kind of stuff you need to be dealing with, depending on exactly what you have in mind.
3. Same as above, but more of an idealistic style intervention, fearing malicious intent from the US government which still controls the DNS system, and trying to prepare for a time when an ICANN-free DNS system may need to be put in place.
Depending on where this stuff is actually going (and if it's the actual owner of the IP space that is doing this) of course...
This is the perfect Man In The Middle attack (Score:5, Insightful)
If only 5% of DNS servers hadn't updated their root servers list, and this server is listed as 1 of the 13 root servers, then these people will have .38% of the entire internet's DNS requests coming through them.
With "control" of a root server (or at least what a DNS client believed was a root server. They would be free to insert whatever records for anything they want. Think banking, finance, email, etc.
So really, the title of this article should have been if you were in organized crime, what would you do if you could transparent MITM (man in the middle) attack .38% of all web traffic on the internet.
My guess is all your accounts belong to us.....
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:1, Funny)
What did they get out of it? Easy....root access! (Score:2, Funny)
What am I missing? (Score:2)
What am I missing?
"It is expected that the old address will continue to work for at least six months after the transition, but will ultimately be retired from service."
Make sure you are up to date! (Score:4, Informative)
ftp://ftp.internic.net/domain/named.cache [internic.net]
Slashdot's junk filter won't allow a cut and paste of the file's contents into a post.
Re: (Score:3, Insightful)
That said, I don't know if trusting your upstream provider is any better...
Re: (Score:2, Informative)
http://www.icann.org/newsletter/ [icann.org]
Re: (Score:2)
The point is, you have to have some system in place, either manual or automatic, to perform the update... Because it's easy to copy the file the first time, insert it into your configuration master image, and then forget about it as you roll out machines, and leave them in production for years with out-of-date hints files.
I know - I've probably don
Re: (Score:1)
I do not rely on package maintainers to keep this file up to date.
Re: (Score:3, Funny)
Re: (Score:1)
If you really wanted to be paranoid about the whole thing, you could also do a lookup for ftp.internic.net via every root server listed in your current named.cache file, and look for discrepancies there as well before you download the file and update your system.
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Gain trust (Score:2)
Re: (Score:1)
Obvious answer already given (Score:2)
As Renesys points out, the volume of traffic to a root server is staggering, so the people running these bogus root servers must have had a reason. What did they get out of it?
So how long has the submitter had this habit of answering his/her own questions before he/she asked them? Staggering amounts of traffic. That IS your answer. Victim machines whose upstream DNS servers didn't update the root server file could be redirected to ad-wrapped versions of "real" websites. If there was far more malicious intent involved, they can redirect, say, baking sites to whatever site they want. Plain and simple.
/me quickly darts off to make sure his root file is up-to-date
Re: (Score:2)
Re: (Score:2)
Providing recipies for spam flavoured muffins.
Mmmmm... malicious
Re: (Score:2)
But that doesn't *seem* to have been happening... that is, they didn't see any indication of it happening in a cursory examination of the sites so if they were they'd have to be pretty carefully targeting it.
One thing that occurred to me is that this would give them a way to scan for common domain typos over a lot of the internet: signals intelligence for later spam ser
Missing Something (Score:1)
Re: (Score:2)
And as far as how they got traffic (which they did, as per the graph in the FA), the hosting companies in question, (in the UK, US, and Hong Kong) started advertising the routes through BGP, (the protocol which tells the backbone routers on the Internet which routers host which IP addresses). So routers which were closer to Community
Anonymous Coward (Score:1, Informative)
Even a 6 year old child would be able to determine when the IP address would be eventually unused (end of May).
From the article quoted as the source of the reference, it is clear that no one tried to verify the information. It would have been very s
historic UK dns name servers (Score:2)
when the old eunet service was finally shut down, there were still a considerable number of people using it as a resolver, and there were still live domains host
It only takes one redirected query... (Score:2, Insightful)
Maybe it was still running? (Score:2)
They could have kept the address, but then provided a note that the configuration was incorrect, but that really dones' help a lot. I, as an end user can't do much to change the configuration of my nameserver. Besides, my nameserver might have been using another nameserver which used another before it got to the root server. All that would
Not horribly major (Score:3, Informative)
Bear in mind that BIND for one doesn't use the root nameserver hints file directly under normal conditions. One of the first things it does is contact one of the servers listed in the hints file and download the real root nameserver list. After that it uses the downloaded list and ignores the hints file. So unless you contacted the L server for that initial download, you'll get the correct root server list and won't ever contact the bogus ones. I'd have to check whether BIND picks a hints entry at random or cycles through starting from the first. If it picks at random the window of vulnerability is small, but if it starts at the first it's virtually nonexistent (most hints files list A, B, C and so on in sequence, and the chance of getting no answer at all from the A-K servers is close to zero).
Why indeed... (Score:4, Insightful)
bill manning
Re: (Score:2)
Can you answer a relevant question which is buzzing around in the background - did CommunityDNS and/or Diyixian have permission to advertise the address space?
Also, as someone else above asked, why did you choose to set up a server at that address, given the bandwidth load and technical effort involved?
Re: (Score:2)
Someday I hope you succeed in getting all the IPv6 stuff going - we'd all like to see that...
Domain-Name Knocking (Score:3, Insightful)
If a phisher wanted to use this, they would only supply a bogus dns pointer to a query if the query was preceded by some 'primer' query. E.g. first someone tries to resolve alpha.com, then beta.com within a few seconds, only then will the root server give the incorrect response for beta.com. This would be pretty easy to do with some cross-site scripting magic.
You can never disprove a conspiracy, after all...
This needs to be fixed. (Score:3, Insightful)
However, the system as it currently exists has one SERIOUS flaw: the reliance on root servers.
We need to switch to a system that does not rely on root servers. There are at least several such systems that are workable. Yes, the U.S. government would lose control over the whole thing. Does ANYBODY in their right mind think that is a bad thing? As long as nobody else can gain root control either, and there are various schemes that can ensure that.
Re: (Score:3, Informative)
ICANN's server was switched off on May 2.
Re: (Score:1)
Not everyone is running their mission-critical apps on decommissioned P3 desktops
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Hopefully you also cache the results along the way, so that when you want to find news.google.com later you don't have to go to the root or
However, wh