Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

[ Create a new account ]

Attack Code Published For DNS Vulnerability

Posted by samzenpus on Wednesday July 23, @07:38PM
from the protect-ya-neck dept.
Security The Internet
get_Rootin writes "That didn't take long. ZDNet is reporting that HD Moore has released exploit code for Dan Kaminsky's DNS cache poisioning vulnerability into the point-and-click Metasploit attack tool. From the article: 'This exploit caches a single malicious host entry into the target nameserver. By causing the target nameserver to query for random hostnames at the target domain, the attacker can spoof a response to the target server including an answer for the query, an authority server record, and an additional record for that server, causing target nameserver to insert the additional record into the cache.' Here's our previous Slashdot coverage."

Related Stories

[+] Kaminsky's DNS Attack Disclosed, Then Pulled 281 comments
An anonymous reader writes "Reverse engineering expert Halver Flake has recently mused on Dan Kaminsky's DNS vulnerability. Apparently his musings were close enough to the mark to cause one of the Matasano team, who apparently already knew of the attack, to publish the details on the Matasano blog in a post entitled 'Reliable DNS Forgery in 2008.' The blog post has since been pulled, but evidence of it exists on Google and elsewhere. It appears only a matter of time now before the full details leak." Reader Time out contributes a link to coverage on ZDNet as well.
Firehose:Attack Code Published for DNS Vulnerability by Anonymous Coward
[+] Patch DNS Servers Faster 144 comments
51mon writes "Austrian CERT used data from one of their authoritative DNS server to measure the rate at which the latest DNS patch (source port randomization) is being rolled out to larger recursive name servers. While about half the traffic (PDF) they receive is now using source port randomization, their data suggest that this is due to ISPs who roll out such fixes immediately. The rate of patching has fallen to disappointingly low levels since. If your ISP isn't patched, perhaps it is time to switch." After details of the DNS vulnerability leaked, researchers |)ruid and HD Moore released attack code; ZDNet's security blog has an analysis.
[+] Apple Still Has Not Patched the DNS Hole 280 comments
Steve Shockley notes an article up at TidBITS on Apple's unexplained failure to patch the DNS vulnerability that we have been discussing for a few weeks now. "Apple uses the popular Internet Systems Consortium BIND DNS server, which was one of the first tools patched, but Apple has yet to include the fixed version in Mac OS X Server, despite being notified of vulnerability details early in the process and being informed of the coordinated patch release date."
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Attack Code Published For DNS Vulnerability 25 Comments More | Login | Reply /

 Full
 Abbreviated
 Hidden
More | Login | Reply
Loading... please wait.

  • Here we go... (Score:4, Interesting)

    by LostCluster (625375) * on Wednesday July 23, @07:41PM (#24312697) Homepage

    This has to be the worst time ever to be a web surfer. How long until we see the major networks broadcasting the legit IP quads of sites we want to reach?

    • Re:Here we go... (Score:5, Informative)

      by Carnildo (712617) on Wednesday July 23, @08:12PM (#24312999) Homepage Journal

      This has to be the worst time ever to be a web surfer. How long until we see the major networks broadcasting the legit IP quads of sites we want to reach?

      There's nothing new about this. DNS cache poisoning attacks have been found before, and the internet hasn't melted down yet. If you're paranoid, run your own caching resolver.

      • Re:Here we go... (Score:5, Interesting)

        by Martin Blank (154261) on Wednesday July 23, @08:28PM (#24313131) Journal

        You may still not be safe. If someone can fire off a XSS attack through your browser, it could do enough lookups to make you vulnerable. Combine this with a periodic other run to a controlled server to grab your source port for guessing (presuming that you have not patched), and you may have a problem.

        Granted, it's unlikely that you would explicitly be targeted, and things like NoScript help defend against it, but there are still possible gaps. In fact, there are several tens of million of systems which will remain vulnerable for some time to come; I haven't seen many SOHO router firmware fixes released so far, and a lot of people point to their routers for their DNS.

          • Re:Here we go... (Score:5, Informative)

            by Martin Blank (154261) on Thursday July 24, @12:01AM (#24314637) Journal

            Where I work, we run the servers through a proxy firewall with a DNS proxy service, and the DNS service on the firewall has been patched for this vulnerability. For traffic run through it, it doesn't preserve source port from the DNS servers, and from a quick glance, the source ports on requests seem to be randomized, so I think from that perspective, we may well be safer even for unpatched servers. However, our setup seems to be the exception, and we may have a couple of other networks (physically and logically separated from the primary) that do not have the benefits of this arrangement.

        • Re:Here we go... (Score:5, Insightful)

          by Anonymous Coward on Wednesday July 23, @09:07PM (#24313395)

          Yes, there was. Before there was bailiwick filtering, spoofing was even easier. Back in the days, DNS servers would even accept "responses" with bogus data out of the blue. We've come a long way and we don't stop here. A patch of bad weather is ahead, but the sky is not falling.

            • Re:Here we go... (Score:5, Informative)

              by spinkham (56603) on Thursday July 24, @08:32AM (#24316845)

              Different vulnerability, that tool checks for non-random TXID, not this exploit.
              This exploit changes the game in letting other exploits work well.
              It's not so much a new class of attack, as a way to give you infinite chances to use the old attacks. If you don't have a IPS checking for this, an attacker who can submit recursive queries to your resolver and wants to poising your DNS will eventually be successful. Publicly available tools work in one minute, Dan says coding in C on a fast connection he's able to do it in 10 seconds.
              Has DNS been broken this badly before? Yes, multiple times. However, the will and knowledge of how to use DNS cache poising for further evil is much higher now then it was in the past. Also, we are becoming increasingly dependent on the Internet, and attacks on the infrastructure do more then just keep us from our news sites.
              As Dan says, "Patch. Today. Now. Yes, stay late."

    • Re:Here we go... (Score:5, Funny)

      by MadMidnightBomber (894759) on Thursday July 24, @03:36AM (#24315577)
      Can someone please send me the HOSTS file for the Internet?

      kthxbye

      • Re:Here we go... (Score:5, Funny)

        by Vectronic (1221470) on Wednesday July 23, @08:19PM (#24313055)

        "And I can hear just about any song I ever would want to hear in less than a minute."

        Shit, you should check out some of the songs that are longer than a minute, there's some good ones out there, but, yes...those quick little punk ditties are good too.

          • Re:Here we go... (Score:5, Interesting)

            by Vectronic (1221470) on Wednesday July 23, @08:49PM (#24313257)

            lol... you should try it, then you wouldnt think so... I just did (in Sound Forge)... cut it down to 1:08, its just noise... cutting it down to 50% is alright though (4:35)... but somewhere around 65% (5:57) is about right, sounds kinda "proper".

  • Google (Score:5, Funny)

    by bdasd5 (1257940) on Wednesday July 23, @07:41PM (#24312699)
    And here I am, thinking I was on Google.
  • And lo, all unpatched websites were rendered unto Goatse.

  • I know (Score:4, Funny)

    by Daimanta (1140543) on Wednesday July 23, @07:52PM (#24312819)

    I exploited this and let a huge cache of people visit my site(127.0.0.1) in stead of the site they wanted to go. It was kickass.

  • See if you're vulnerable (Score:5, Informative)

    by neokushan (932374) on Wednesday July 23, @08:20PM (#24313061)

    There's a tool on the site below that apparently checks if the DNS you're currently using is vulnerable to such an attack. I checked my work DNS and my home DNS - both were fine. Apparently OpenDNS is secure as well, so there's probably nothing to worry about.

    http://www.doxpara.com/ [doxpara.com]

  • I used one of the tests below and found that my ISP's DNS servers were vulnerable. Now I am using the OpenDNS [opendns.com] servers on all of my clients instead:

    208.67.222.222
    208.67.220.220

    Their servers are not vulnerable, and you can create an account to enable things like antiphishing at the DNS level (much better idea then a browser plug-in).

    If you find that your ISP's routers are vulnerable, your best bet is switch to OpenDNS...or just run your own caching server.

  • Microsoft's hamfisted "patch" (Score:5, Informative)

    by bizitch (546406) on Wednesday July 23, @10:26PM (#24314039) Homepage

    In case anyone is dumb enough to use a Microsoft DNS server as a authoritative internet DNS server -

    MS has released two lovely patches -

    KB951746 and KB951748

    The problem with this fix is that it turns the DNS.EXE daemon into a UDP socket grubbing whore.

    After the patch, the DNS.EXE daemon grabs no less than 2500 freaking UDP sockets.

    This wreaks havoc on anything that - you know - needs UDP sockets on the same server.

    So far Zonealarm, Blackberry BES and Sphericall VOIP software all break with this "patch"

    Stay tuned for more fun to come ...

    • Re:And the "fix" isn't (Score:4, Interesting)

      by cortana (588495) <samNO@SPAMrobots.org.uk> on Wednesday July 23, @08:06PM (#24312941) Homepage

      The fix is DNSSEC.

      • Re:And the "fix" isn't (Score:5, Interesting)

        by _Knots (165356) on Wednesday July 23, @09:32PM (#24313621)

        DNSSEC is a steaming pile, though after thirteen years, many RFCs -- each of which read "This Time For Sure!" -- it may in fact be workable.

        It is _a_ fix to this problem, but there are many simpler fixes that seemingly are being discarded for reasons I don't quite understand -- perhaps more full threat models are the target problem, but securing DNS doesn't make sense if we're then going to use HTTP to the addresses resolved! On the flip side, if we were using TLS everywhere, then dicking with DNS amounts to a DoS, which is much less powerful than the arbitrary redirection attacks we have now.

        One such simpler fix is using EDNS0 to add a nonce RR (goes out in the Query, comes back in the Additional section). And while EDNS0 is subject to rollback attacks, DNSSEC depends on EDNS0. So that's not an excuse not to use it.

    • Re:DNS Glue poisoning was already known... (Score:5, Insightful)

      by Anonymous Coward on Wednesday July 23, @08:51PM (#24313277)

      Congratulations, you confused the mods. Bailiwick checking was added to all DNS resolvers in response to glue poisoning and made cache poisoning through spoofed glue records very difficult. The current problem is that the typical filter rules are insufficient for stopping a glue poisoning attack which appears to come from the authoritative server: Kaminsky found a way around the glue poisoning countermeasure. This means that a very dangerous kind of attack which was thought to be defeated is now possible again.

      • Re:DNS Glue poisoning was already known... (Score:5, Informative)

        by blueg3 (192743) on Wednesday July 23, @09:21PM (#24313515)

        It only works because the DNS server caches the result of the glue record, against the recommendation of the above writer.

        The glue record is necessary if, say, you need to provide the address of a nameserver when you provide the name of the authoritative nameserver for a query. You should use that glue record for that query only.

        What happens is that an attacker queries lbixds.google.com (or some other nonexistent domain) and then sends the server he issued that request to a response to that query that also has a glue record giving a false address for ns.google.com. If the DNS server only used that false address for resolving lbixds.google.com, cached lbixds.google.com, and left it at that, then lbixds.google.com would be the only entry the attacker could poison -- basically useless. However, the DNS server caches the glue record giving the address for ns.google.com, too.

          • Re:DNS Glue poisoning was already known... (Score:5, Informative)

            by blueg3 (192743) on Thursday July 24, @12:13AM (#24314677)

            So, first part. An attacker is trying to poison a DNS cache. Generally, he'd be interested in poisoning a DNS server that's a caching server for a group of people, like one run by a regional ISP. An efficient way of getting a poisoned record into its cache is to issue a request to that server, and then immediately send a forged response to the server. So, for example, I issue my local nameserver a request for abcd.google.com. It doesn't have this cached (you don't say!), so it starts trying to resolve it. I quickly send it a forge response for abcd.google.com, and it believes me. Transaction IDs make this a slim chance that it'll believe me, but it's still a chance, and I can issue a ton of requests to different fake addresses.

            The answer to the second part is tricky. Basically, say I want to resolve mail.google.com. I have nothing about google.com in my cache. So I contact the nameserver for .com. It isn't authoritative for the google.com domain, but it knows who is, and it tells me so. (Say that it's ns.google.com.) Knowing ns.google.com is the nameserver for that domain is useless without its IP address, so it tacks on a glue record that gives me the address of ns.google.com. Now I can contact ns.google.com to ask it the IP of mail.google.com.

            Originally, these records were just accepted. This is a huge security hole: I could request bob.domainiown.com, send a legitimate response (I control domainiown.com), and tack on a record telling them where ns.google.com is, even though I'm not authoritative for that. Now, such a record can only be attached to a request that is in the same domain, so I need to ask for bob.google.com to attach an ns.google.com record, which requires me to forge a response.

            There are a number of situations where these auxiliary records are necessary, so they can't just be ignored. However, they shouldn't be cached -- they should be used only for the one request that generates them.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2008 SourceForge, Inc.