Support Code writes "ZDNet's Zero Day blog is reporting that a DNS server of one of China's largest ISPs has been poisoned to redirect typos to a malicious site rigged with drive-by exploits. The DNS poisoning attacks are affecting customers of China Netcom (CNC) and are using a malicious iFrame to launch exploits for known vulnerabilities in RealNetworks' RealPlayer, Adobe Flash Player and Microsoft Snapshot Viewer. In this interview with CNet, Dan Kaminsky confirms that attacks are definitely going on in the field."
It may be like a reflex now, but at least the "iFrame" name is derived from what it actually is (an Inline Frame) and not just a letter stuck somewhere as part of a marketing or branding gimmick.
I knew that. The whole iLine of products is really annoying to me. Same goes for eMachines, and I have to admit the whole K thing with KDE apps is kind of annoying too. But KDE is still better than GNOME, flamewar go! *ducks*
Can we check the IP origin of that last post please?
*ring*ring* Badguy1: "Hello" Badguy2: "Hi its me, you ready to do this thing tonight?" Badguy1: "sure, dont forget to bring the stuff" *click* Badguy2: "hey did you just hear a click on the line?" Badguy1: "yeah! - do you think we are being tapped by the NSA?" Anonymous Coward: "No its not our style" Badguy1: "OK" Badguy2: "OK"
I know you're just trying to be funny, but allow me still to (hopefully) educate some of your readers.
If anyone was wiretapping and using reasonably well-designed equipment, you wouldn't hear clicks, since clicks can be avoided. I think "high-impedance circuitry" was the phrase used to justify that claim.
Also, if the wiretappers are playing by the rules, you can just press C on your phone (or play back two tones with the corresponding frequencies but less amplitude than your phone does) to shut down the recording equipment at the other end.
Interesting to know, if you plan on being wiretapped. What's also interesting to know is that wiretapping equipment is (usually) illegal to posses, yet can be bought from law enforcement agencies on ebay:)
... I feel a bit lucky because I never trust my ISP's name servers. I knew this day would come. If possible, I always use the OpenDNS servers. (Disclaimer here: I'm not saying the OpenDNS service is recommended for security. It's just a matter about reputation.)
This is a very good question. Frankly, I don't know. As I have said, I never trust OpenDNS out of security reasons. I use it for my desktop browsing, not for anything worthy enough to be protected.
But I know from my own experience that some Chinese ISPs are seriously incompetent in managing security risks. I have seen some of their mistakes in securing their service so that I wouldn't trust them again. OTOH I know I have to buy their services to get online and put these rants here and that sound like a paradox. Maybe it is.
Finally we have to trust somebody else. That's how we make our lives. I just chose to deal with one who has *already* made a bad reputation as little as possible.
It's not only China that have ISP's that manipulate DNS records... Here in Denmark for instance most ISP's voluntarily manipulate DNS for a whole list of domains known to host kiddie porn causing a redirect to a warning page. But they also censor the net by 'preventing access' to domains like allofmp3.com and thepiratebay.org which were 'banned' by Fodgedretten, a commerce-oriented court, based on bogus claims of extending danish jurisdiction to foreign-based websites (Russia and Sweden). Unfortunately nobody has yet filed an appeal of these verdicts, so they stand - unvalidated.
Anyway, this censorship has caused most somewhat technically-oritented people to switch to other nameservers than those provided by their ISPs, usually OpenDNS but also private nameservers they trust. I use our company's which I run (and keep patched!) so I can circumvent the censorship.
In Finland they use same method and the black list is extremely idiotic (and most likely illegal - unfortunately government refuses to do anything about it).
Exactly. But there is a workaround. Just sign up for an OpenDNS free account and you can turn their "features" off in your preferences. Once configured OpenDNS works just like normal DNS servers that return NXDOMAIN on unknown domains, which is all I want.
For dynamic IP users like me a bit more work is necessary: find a way to report the IP to OpenDNS so it knows it is you. I use the ddclient [sourceforge.net] daemon to update my IP information to OpenDNS and things are working reasonably well so far.
OpenDNS has drawbacks too. They redirect Google.com and all non-existent domains to their own crappy search engine.
Which causes my VPN (Nortel) not to work. DNS lookups to Intranet domains only work if they fail properly on the primary network adapter so they are tried on the virtual adapter. With OpenDNS all Intranet names are resolved to the same (OpenDNS I assume) IP address unless I change the DNS server ordering manually each time I connect.
Check our own ISPs name servers, openDNS's name servers, and we need a third independent name server pool.
Check all three before moving accepting the IP, and if there is any disagreement, just don't go. Also, send an automated warning to all three DNS pools to re-seed their random number generators and clear the contested IP from their cache.
Of course, I'm talking about DNS pools as if they already exist. But they should.
Interactions that need to be secured should also use independent multiple polling before exchanging tokens. Financial institutions, for instance, should keep their own private supernetwork, such that the customer queries their local branch to start login, then queries two other bank-owned check servers, to make sure the branch IP is what the bank says it should be. This would require dedicated browsers, but that's really a given. It's time to quit giving popular browser M, I, or E our credit card numbers to play with. The convenience is not worth it.
Anything that's important will be using SSL, so even if someone does hijack your bank's DNS entries your browser will warn you that their certificate isn't signed by someone you trust. The only real worry is from typos or bad links, which is why it's recommended practice to never click links in emails to go to sites that you're going to have to log in to, but rather to use a bookmark or type and check the address yourself.
As for the "check against lots of different servers" idea, there's three main problems.
1. If the "pools" are very independent of each other (i.e. different management) then it just makes DoS attacks against certain sites very easy (get in the pool, behave for a while, then start serving nonsense results for www.example.com - voila, anyone using your server to verify addresses will reject that domain).
2. If the pools are under the same management, then they're very likely to be running the same software version on the same platform under the same firewall protection, etc. So an attacker may need to compromise some more servers, but they're all identical.
3. For your financial institutions example, how does the browser know which "check servers" to use? You can't rely on a single reply from one of their authoritative servers, since you don't trust them. If you ask a bunch of other servers, then you're trusting all of them not to be trying to DoS the site in question (and also not to be poisoned themselves).
I guess you could be intending that each bank supplies a browser for use with its website, but then you take a lot of the convenience out of using online banking; in particular, cross-platform support would be a problem.
ssl -- you can only trust your bank if your bank can trust you. They have to see your certificate, too. Where do you get your certificate?
1. I'm talking about pools as in, your ISPs main and backup DNS servers are one pool. The openDNS servers you can choose to reference form another pool. The third pool would be like openDNS, but managed separately.
The servers within the pool regularly check each other and flag and sequester rogues. When a client gets a mismatch, it would report that mismatch to all three
ssl -- you can only trust your bank if your bank can trust you. They have to see your certificate, too. Where do you get your certificate?
Why can't you trust your bank if your bank can't trust you? My bank has an SSL certificate which does a reasonable job of ensuring that when I connect to online.westpac.com.au, I'm connecting to a server operated by Westpac, and not some other server that my hijacked DNS is mistakenly pointing me to, and that someone on a router between me and my bank isn't eavesdropping. It's unnecessary for my bank's server to trust me at this point; they trust me after I supply my customer number and password over the en
Well, I have to admit, the unanimous polling is probably overkill for web surfing, and overkill usually opens more holes. And it is all too easy to try to fix the social engineering vulnerabilities.
You know the websites you visit regularly by pattern recognition, and "trust systems" have to be able somehow to take advantage of what the user knows. Maybe it would be better to provide an alternate opinion function. Press a button and your surfing browser asks two other DNS servers, preferably separately manag
Okay, I forgot one important property of certificate-based authentication: even if you present your certificate to a hostile party, they can't use it to pretend to be you. That and mutual authentication pretty much negates phishing as an attack vector altogether, whether it's via social engineering, DNS spoofing or some other method of covertly hijacking communications between two parties. The only way to interfere with such a transaction would be to compromise the security of either the user's computer or
The only real fix available now for the fundamental vulnerability is DNSSEC. There's an excellent doc up on ISC's site called DNSSEC in Six Minutes [isc.org] for those who read bothered to read Kaminsky's actual presentation (especially the last 40 or so slides on subtle ways security systems like SSL break when you can't trust DNS), put that together with the ten hour exploit for patched servers [milw0rm.com], and realised we're not out of the woods yet by a long chalk...
Yeah, and I'm not sure how to fit dyndns.com's services into this idea, either.
But certificates are not really appropriate for DNS when you're just surfing, even if Verisign hadn't trashed the current authorization space. Not unless ISPs start making server certificates part of their basic package. (In the end, everyone is going to have their own web server to take messages and host bulletin board/blogs.)
Certificates can only work vertically (hierarchically) within an organization. In public, certificates h
Someone's decided to make DNS poisoning an Olympic sport. Obviously the only place to do it at the moment is China.
I've got images in my head of a broken toothed Chinese geek running around Beijing with an EEE PC and a Linksys wireless router hooked to a 12V SLA battery, lights a-blinking, instead of the Olympic torch. Thank goodness the Olympics are about to end.
It's a big flaw. Someone big was bound to fall foul of it eventually. And to be honest, I can't say that I'm at all surprised. In fact, I'm expecting a lot more.
I bet that there are still hundreds of large companies that are vulnerable worldwide and I bet that translates to hundreds of thousands, if not millions, of affected people. For instance, last time I checked the whole LGfL (London Grid for Learning) was vulnerable - and they provide DNS / Internet connectivity for every school in London (several million users, hundreds if not thousands of schools) with little alternative because they have been mandated as the recommended solution and thus all "interesting" content is in their private network.
If they ARE still compromised (and several days after the release of the information, they were still showing up as vulnerable on all those DNS tests and today I got: Your name server, at ***.***.***.***, appears vulnerable to DNS Cache Poisoning. All requests came from the following source port: 32768), that's virtually every school, staff member and student in London (we're probably talking close on a million people because it includes Greater London Boroughs but I'm not sure of the exact figure) which are in trouble because they use the upstream DNS from LGfL as their basis.
Have we heard anything through official channels? Nope. Does everybody just trust LGfL to do their job transparently? Yep. Have they done it? Apparently not. Have they even heard of it? I don't know, but there have been zero advisories, zero visible configuration changes, that I can see.
Give it a few months, one of the students will download something and poison the whole of London's educational system and THEN maybe someone will bother to look into it.
When I heard about this flaw, the first thing I did was check all upstream servers that either my servers or my own home computers use - my cheap ISP (PlusNet) had apparently fixed the issue before I'd even caught wind of the "there may be a DNS problem" posts on Kaminsky's blog. Every other one just seems to be dragging their feet.
"iFrame"? Lower-case i, uppercase next letter? How odd. It's "inline frame", normally all caps ('IFRAME') or all lower-case ('iframe'). "iFrame" makes it sound like some new Apple-branded house support structure with built-in Internet-something.
They're not trying "to do damage to China," they're trying to enlist more computers into botnets to spread email that sells fake \/iaGrA pills and penile enhancements to stupid people, and possibly to redirect unwitting browsers to ad-sponsored pages. It's motivated by Greed! It's the new (inter)nationalism, and unfortunately it knows no national boundaries.
So we know there is an exploit and it is being redirected to a website...but no one in law enforcement can determine where that IP is located? They're running the scam out in the public, for cripes sake. It's not even like the old shell scam on a card table, where you had to have compatriots looking around the corners for policmen on foot patrols. These scammers have their card tables set up in front of the precinct office.
Yes it is a hole. Yes it needs to be fixed. But would the perps be that difficul
Chinese speakers (at least in Beijing) often use the word é£ä (neige) [sheik.co.uk] as a filler word; much in the same way as 'uh' or 'er' are used in the English language.
For anyone with no understanding of the Chinese language will often be confronted by the words 'nigga, nigga' when walking on the streets of Beijing.
It's <iframe> (Score:5, Funny)
Re:It's (Score:3, Insightful)
Re: (Score:3, Informative)
Re: (Score:2)
Btw - what does the "i" have to do with apple anyhow?
Re: (Score:2)
Cyberwar (Score:2)
Whenever attacks target specific countries, I wonder.... Yeah, I guess I'm feeling a little paranoid tonight.
Re: (Score:2)
Re:Cyberparanoia (Score:5, Funny)
lol
Can we check the IP origin of that last post please?
*ring*ring*
Badguy1: "Hello"
Badguy2: "Hi its me, you ready to do this thing tonight?"
Badguy1: "sure, dont forget to bring the stuff"
*click*
Badguy2: "hey did you just hear a click on the line?"
Badguy1: "yeah! - do you think we are being tapped by the NSA?"
Anonymous Coward: "No its not our style"
Badguy1: "OK"
Badguy2: "OK"
Parent
Re:Cyberparanoia (Score:5, Informative)
I know you're just trying to be funny, but allow me still to (hopefully) educate some of your readers.
If anyone was wiretapping and using reasonably well-designed equipment, you wouldn't hear clicks, since clicks can be avoided. I think "high-impedance circuitry" was the phrase used to justify that claim.
Also, if the wiretappers are playing by the rules, you can just press C on your phone (or play back two tones with the corresponding frequencies but less amplitude than your phone does) to shut down the recording equipment at the other end.
Source: Matt Blaze, http://www.usenix.org/events/lisa05/tech/mp3/blaze.mp3 [usenix.org], http://www.usenix.org/events/lisa05/tech/ [usenix.org].
Interesting to know, if you plan on being wiretapped. What's also interesting to know is that wiretapping equipment is (usually) illegal to posses, yet can be bought from law enforcement agencies on ebay :)
Parent
Re: (Score:1)
Re: (Score:2)
Yeah. The NSA sends Sam Fisher.
Real Player exploits? (Score:2, Funny)
Re: (Score:1)
Re: (Score:2)
Since when (Score:5, Funny)
Since when do I have to input my SSN to post to slashdot?
Re: (Score:2)
Ever since you mistyped http:/// [http].
And what is M$ doing? (Score:2, Funny)
As a Chinese Internet user... (Score:5, Interesting)
... I feel a bit lucky because I never trust my ISP's name servers. I knew this day would come. If possible, I always use the OpenDNS servers. (Disclaimer here: I'm not saying the OpenDNS service is recommended for security. It's just a matter about reputation.)
The Chinese ISPs has been known to use manipulated DNS records as a censorship measure, too. See here: http://slashdot.org/article.pl?sid=07/11/18/1824230 [slashdot.org]
Re: (Score:3, Interesting)
So what makes you think OpenDNS were not the first DNS servers attacked?
That's what I'd do.
Re:As a Chinese Internet user... (Score:5, Informative)
Parent
Re: (Score:2, Interesting)
Re:As a Chinese Internet user... (Score:5, Insightful)
Parent
Re: (Score:2)
I feel a bit lucky because I never trust my ISP's name servers. I knew this day would come. If possible, I always use the OpenDNS servers.
If you were really worried about it you would run your own resolving-server on your machines.
Re: (Score:2)
And check your NAT didn't screw up your source-port-randomisation.
Re:As a Chinese Internet user... (Score:5, Interesting)
It's not only China that have ISP's that manipulate DNS records... Here in Denmark for instance most ISP's voluntarily manipulate DNS for a whole list of domains known to host kiddie porn causing a redirect to a warning page. But they also censor the net by 'preventing access' to domains like allofmp3.com and thepiratebay.org which were 'banned' by Fodgedretten, a commerce-oriented court, based on bogus claims of extending danish jurisdiction to foreign-based websites (Russia and Sweden). Unfortunately nobody has yet filed an appeal of these verdicts, so they stand - unvalidated.
Anyway, this censorship has caused most somewhat technically-oritented people to switch to other nameservers than those provided by their ISPs, usually OpenDNS but also private nameservers they trust. I use our company's which I run (and keep patched!) so I can circumvent the censorship.
Parent
Re: (Score:2)
known to host kiddie porn
"known" or "alleged"?
"to host" or "picasa" (or hacked sites)?
"kiddie porn" or "gay porn"?
In Finland they use same method and the black list is extremely idiotic (and most likely illegal - unfortunately government refuses to do anything about it).
Re:As a Chinese Internet user... (Score:5, Informative)
Parent
Re:As a Chinese Internet user... (Score:5, Informative)
Exactly. But there is a workaround. Just sign up for an OpenDNS free account and you can turn their "features" off in your preferences. Once configured OpenDNS works just like normal DNS servers that return NXDOMAIN on unknown domains, which is all I want.
For dynamic IP users like me a bit more work is necessary: find a way to report the IP to OpenDNS so it knows it is you. I use the ddclient [sourceforge.net] daemon to update my IP information to OpenDNS and things are working reasonably well so far.
Parent
Re: (Score:2)
OpenDNS has drawbacks too. They redirect Google.com and all non-existent domains to their own crappy search engine.
Which causes my VPN (Nortel) not to work. DNS lookups to Intranet domains only work if they fail properly on the primary network adapter so they are tried on the virtual adapter. With OpenDNS all Intranet names are resolved to the same (OpenDNS I assume) IP address unless I change the DNS server ordering manually each time I connect.
Re: (Score:3, Interesting)
I always hear people on Slashdot bitching about OpenDNS. Apart from running my own resolver, what are my other options?
unanimous multi-polling? (Score:5, Interesting)
Check our own ISPs name servers, openDNS's name servers, and we need a third independent name server pool.
Check all three before moving accepting the IP, and if there is any disagreement, just don't go. Also, send an automated warning to all three DNS pools to re-seed their random number generators and clear the contested IP from their cache.
Of course, I'm talking about DNS pools as if they already exist. But they should.
Interactions that need to be secured should also use independent multiple polling before exchanging tokens. Financial institutions, for instance, should keep their own private supernetwork, such that the customer queries their local branch to start login, then queries two other bank-owned check servers, to make sure the branch IP is what the bank says it should be. This would require dedicated browsers, but that's really a given. It's time to quit giving popular browser M, I, or E our credit card numbers to play with. The convenience is not worth it.
Parent
Re:unanimous multi-polling? (Score:4, Interesting)
Anything that's important will be using SSL, so even if someone does hijack your bank's DNS entries your browser will warn you that their certificate isn't signed by someone you trust. The only real worry is from typos or bad links, which is why it's recommended practice to never click links in emails to go to sites that you're going to have to log in to, but rather to use a bookmark or type and check the address yourself.
As for the "check against lots of different servers" idea, there's three main problems.
1. If the "pools" are very independent of each other (i.e. different management) then it just makes DoS attacks against certain sites very easy (get in the pool, behave for a while, then start serving nonsense results for www.example.com - voila, anyone using your server to verify addresses will reject that domain).
2. If the pools are under the same management, then they're very likely to be running the same software version on the same platform under the same firewall protection, etc. So an attacker may need to compromise some more servers, but they're all identical.
3. For your financial institutions example, how does the browser know which "check servers" to use? You can't rely on a single reply from one of their authoritative servers, since you don't trust them. If you ask a bunch of other servers, then you're trusting all of them not to be trying to DoS the site in question (and also not to be poisoned themselves).
I guess you could be intending that each bank supplies a browser for use with its website, but then you take a lot of the convenience out of using online banking; in particular, cross-platform support would be a problem.
Parent
Re: (Score:2, Informative)
ssl -- you can only trust your bank if your bank can trust you. They have to see your certificate, too. Where do you get your certificate?
1. I'm talking about pools as in, your ISPs main and backup DNS servers are one pool. The openDNS servers you can choose to reference form another pool. The third pool would be like openDNS, but managed separately.
The servers within the pool regularly check each other and flag and sequester rogues. When a client gets a mismatch, it would report that mismatch to all three
Re: (Score:2)
ssl -- you can only trust your bank if your bank can trust you. They have to see your certificate, too. Where do you get your certificate?
Why can't you trust your bank if your bank can't trust you? My bank has an SSL certificate which does a reasonable job of ensuring that when I connect to online.westpac.com.au, I'm connecting to a server operated by Westpac, and not some other server that my hijacked DNS is mistakenly pointing me to, and that someone on a router between me and my bank isn't eavesdropping. It's unnecessary for my bank's server to trust me at this point; they trust me after I supply my customer number and password over the en
Re: (Score:2)
Well, I have to admit, the unanimous polling is probably overkill for web surfing, and overkill usually opens more holes. And it is all too easy to try to fix the social engineering vulnerabilities.
You know the websites you visit regularly by pattern recognition, and "trust systems" have to be able somehow to take advantage of what the user knows. Maybe it would be better to provide an alternate opinion function. Press a button and your surfing browser asks two other DNS servers, preferably separately manag
certificate just a very strong password? (Score:2)
Get back, troll.
Re: (Score:2)
Okay, I forgot one important property of certificate-based authentication: even if you present your certificate to a hostile party, they can't use it to pretend to be you. That and mutual authentication pretty much negates phishing as an attack vector altogether, whether it's via social engineering, DNS spoofing or some other method of covertly hijacking communications between two parties. The only way to interfere with such a transaction would be to compromise the security of either the user's computer or
Re: (Score:3, Interesting)
Re: (Score:2, Informative)
Yeah, and I'm not sure how to fit dyndns.com's services into this idea, either.
But certificates are not really appropriate for DNS when you're just surfing, even if Verisign hadn't trashed the current authorization space. Not unless ISPs start making server certificates part of their basic package. (In the end, everyone is going to have their own web server to take messages and host bulletin board/blogs.)
Certificates can only work vertically (hierarchically) within an organization. In public, certificates h
Olympic DNS poisoning (Score:3, Funny)
Someone's decided to make DNS poisoning an Olympic sport. Obviously the only place to do it at the moment is China.
I've got images in my head of a broken toothed Chinese geek running around Beijing with an EEE PC and a Linksys wireless router hooked to a 12V SLA battery, lights a-blinking, instead of the Olympic torch. Thank goodness the Olympics are about to end.
It's a big flaw (Score:5, Interesting)
It's a big flaw. Someone big was bound to fall foul of it eventually. And to be honest, I can't say that I'm at all surprised. In fact, I'm expecting a lot more.
I bet that there are still hundreds of large companies that are vulnerable worldwide and I bet that translates to hundreds of thousands, if not millions, of affected people. For instance, last time I checked the whole LGfL (London Grid for Learning) was vulnerable - and they provide DNS / Internet connectivity for every school in London (several million users, hundreds if not thousands of schools) with little alternative because they have been mandated as the recommended solution and thus all "interesting" content is in their private network.
If they ARE still compromised (and several days after the release of the information, they were still showing up as vulnerable on all those DNS tests and today I got: Your name server, at ***.***.***.***, appears vulnerable to DNS Cache Poisoning. All requests came from the following source port: 32768), that's virtually every school, staff member and student in London (we're probably talking close on a million people because it includes Greater London Boroughs but I'm not sure of the exact figure) which are in trouble because they use the upstream DNS from LGfL as their basis.
Have we heard anything through official channels? Nope.
Does everybody just trust LGfL to do their job transparently? Yep.
Have they done it? Apparently not.
Have they even heard of it? I don't know, but there have been zero advisories, zero visible configuration changes, that I can see.
Give it a few months, one of the students will download something and poison the whole of London's educational system and THEN maybe someone will bother to look into it.
When I heard about this flaw, the first thing I did was check all upstream servers that either my servers or my own home computers use - my cheap ISP (PlusNet) had apparently fixed the issue before I'd even caught wind of the "there may be a DNS problem" posts on Kaminsky's blog. Every other one just seems to be dragging their feet.
iDon't Like It (Score:2, Funny)
check your server (Score:4, Informative)
Just a warm-up (Score:3, Interesting)
If they were trying to do damage to china, wouldn't they have simply redirected everyone to anti-government propaganda sites instead?
Re: (Score:3, Insightful)
Redirected? (Score:2)
So we know there is an exploit and it is being redirected to a website...but no one in law enforcement can determine where that IP is located? They're running the scam out in the public, for cripes sake. It's not even like the old shell scam on a card table, where you had to have compatriots looking around the corners for policmen on foot patrols. These scammers have their card tables set up in front of the precinct office.
Yes it is a hole. Yes it needs to be fixed. But would the perps be that difficul
Re: (Score:1, Funny)
I'd like to buy a vowel. A.
Re: (Score:2, Interesting)
Obviously some moderator never has never seen this [wikipedia.org].
Re: (Score:2)
Yeah, and he sure taught you a lesson by modding your explanation of the first post Offtopic.
How dare you point out his ignorance!
Re:Frosty Post!!1 (Score:5, Informative)
In fact Frosty Post AC has a point.
Chinese speakers (at least in Beijing) often use the word é£ä (neige) [sheik.co.uk] as a filler word; much in the same way as 'uh' or 'er' are used in the English language.
For anyone with no understanding of the Chinese language will often be confronted by the words 'nigga, nigga' when walking on the streets of Beijing.
Parent