Slashdot Log In
DNS Flaw Hits More Than Just the Web
Posted by
timothy
on Thu Aug 07, 2008 12:59 PM
from the gee-dan-thanks-thanks-a-bunch dept.
from the gee-dan-thanks-thanks-a-bunch dept.
gringer writes "Dan Kaminsky presented at the Black Hat conference in Las Vegas on Wednesday, and said that the DNS vulnerability he discovered is much more dangerous than most have appreciated.
Besides hijacking web browsers, hackers might attack email services and spam filters, FTP, Rsync, BitTorrent, Telnet, SSH, as well as SSL services. Ultimately it's not a question of which systems can be attacked by exploiting the flaw, but rather which ones cannot. Then again, it could just be hype.
For more information, see Kaminsky's power point presentation." Update: 08/07 19:48 GMT by T : There's also an animation of the progress of the patch.
Related Stories
[+]
IT: Kaminsky DNS Bug Claimed Fixed By 1-Character Patch 112 comments
An anonymous reader writes "According to a thread on the bind-users mailing list, there is nothing inherent in the DNS protocol that would cause the massive vulnerability discussed at length here and elsewhere. As it turns out, it appears to be a simple off-by-one error in BIND, which favors new NS records over cached ones (even if the cached TTL is not yet expired). The patch changes this in favor of still-valid cached records, removing the attacker's ability to successfully poison the cache outside the small window of opportunity afforded by an expiring TTL, which is the way things used to be before the Kaminsky debacle. Source port randomization is nice, but removing the root cause of the attack's effectiveness is better."
Update: 08/29 20:11 GMT by KD : Dan Kaminsky sent this note: "What Gabriel suggests is interesting and was considered, but a) doesn't work and b) creates fatal reliability issues. I've responded in a post here."
Update: 08/29 20:11 GMT by KD : Dan Kaminsky sent this note: "What Gabriel suggests is interesting and was considered, but a) doesn't work and b) creates fatal reliability issues. I've responded in a post here."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
SSH and SSL protected (Score:5, Informative)
SSH will raise the key changed warning if you've connected before.
SSL will raise a certificate error unless they have some way of getting a fake cert.
Re:SSH and SSL protected (Score:5, Informative)
Parent
Re:SSH and SSL protected (Score:5, Interesting)
Parent
Re:SSH and SSL protected (Score:5, Insightful)
someone could hijack your bank website, use a self-signed certificate and Firefox would just ignore the authentication error.
What's to stop somebody from hijacking the bank website, redirecting to a website that uses no SSL at all, and waiting for the passwords to roll in?
Firefox and IE will, by default, warn you about sending unencrypted passwords. Once. And no more than once.
Of course, many or perhaps even most people will notice that the site is unencrypted, but the attacker doesn't need to fool everybody. Even a 20% success rate is plenty good enough.
Parent
Re:SSH and SSL protected (Score:5, Insightful)
What's to stop somebody from hijacking the bank website, redirecting to a website that uses no SSL at all, and waiting for the passwords to roll in?
If you normally access your bank's website by way of https, you wouldn't get redirected because the hijacked website's certificate wouldn't be valid. Other than that, you're just describing phishing.
Parent
Shocked!!! (Score:5, Insightful)
You mean all the services that use DNS are at risk?!?!?!
Say it isn't so...!
Here all this time I thought the Internet WAS the Web...
Gopher (Score:5, Funny)
Parent
wow (Score:5, Funny)
its almost like every service that uses hostnames might be affected.
Re:wow (Score:5, Funny)
That's why I only navigate using IP addresses... damn kids with their domain names!
Get off my lawn!
Parent
To everyone on 216.34.181.45 (Score:5, Funny)
And they called me a fool when I refused to learn website names WHO'S LAUGHING NOW!!
Re:To everyone on 216.34.181.45 (Score:5, Funny)
Domain Name: LAUGHINGNOW.COM
Registrar: GODADDY.COM, INC.
Whois Server: whois.godaddy.com
Referral URL: http://registrar.godaddy.com/ [godaddy.com]
Name Server: NS1.ACTIVEAUDIENCE.COM
Name Server: NS2.ACTIVEAUDIENCE.COM
Status: clientDeleteProhibited
Status: clientRenewProhibited
Status: clientTransferProhibited
Status: clientUpdateProhibited
Updated Date: 06-aug-2008
Creation Date: 11-mar-2005
Expiration Date: 11-mar-2009
Parent
Litmus testing (Score:5, Insightful)
If you are reading this on Slashdot, and you are just now realizing that DNS exploits affect more than just the web, then get the hell out of here. Shoo. Leave your card at the door.
Re:Litmus testing (Score:5, Funny)
Wait, we need to know tech to be here? I thought we just had to be libertarian and anti-copyright.
Parent
Re:Litmus testing (Score:5, Funny)
Nah. Those are just the requirements for upmodding. You can still hang around otherwise, but we might not talk to you.
Parent
Re:Litmus testing (Score:5, Insightful)
Sorry Kirk, we can't win this battle. Back in the day only professionals, nerds and skilled technicians visited Slashdot. These days the site (for monetary reasons, I'm sure) has to cater to a much larger audience and we have to accept that we, the low-digit-UID crowd, are no longer representative for Slashdot.
The only problem is, our chances are not much better anywhere else. I miss the days when the Internet consisted mostly of early adopters. (Then again, we need the masses because they make it feasible to have actually useful things like Internet banking and on-line pizza orders.)
Parent
Re:Litmus testing (Score:5, Funny)
I doubt that the union of "people who think the web is the Internet" and "people who discover Slashdot and stick around" is more than a handful.
Actually, I imagine the union would be enormous. Perhaps you meant the intersection?
Parent
Surprised? (Score:5, Funny)
This is why I've maintained a comprehensive /etc/hosts file since 1996. Every now and then it gets to be a bit large, so I periodically print it out and cache it to a shelf full of 3-ring binders.
Bittorrent? Not really. (Score:5, Informative)
News for the masses (Score:5, Insightful)
This might surprise people relatively new to technology, but it should be obvious to anyone who's been in the field for a while.
If you can hijack DNS, you can of course replace any networked service with your own (as man-in-the-middle attack or otherwise). If you change the road signs on an intersection in the countryside, not just cars are vulnerable - all traffic is.
This would have been an interesting and informative story in the early days of Slashdot when we were all still new to the concepts of Internet. Anno 2008, I would have expected more from the editors (maybe not the new recruit, but timothy has been around for a long time). News for nerds has become news for the masses, it seems.
Maybe I should stop reading the main page and start checking only Science, Mobile and YRO.
Do I understand this right? (Score:5, Informative)
Bad guy can force the name server to go run to the good guy and look something up It takes time to get the real request (with random number) to the good guy It takes more time to get the real response back from the good guy It takes no time for the bad guy to immediately follow up a request with a fake response Might have the wrong random number, but it'll definitely arrive first
So:
1) Bad guy pretends he's a desktop pc (Stub Resolver)
2) Bad guy as Stub Resolver asks some arbitrary name server for the target's address
2) Bad guy knows the name server will eventually ask the target
3) Bad guy spoofs the target and sends his own replies back to the name server
4) One of the bad guy's spoof replies happens to match the Transaction ID
6) Name server thinks the bad guy's reply cames from target
7) Name server thinks the target lives at the IP address in Bad Guy's spoofed reply
Wide open internet is doomed. (Score:5, Interesting)
I RTFA. At this point, we're hanging all of our eggs into the encyrption basket. If someone proves P=NP and breaks SSL, the whole internet is hosed. Now again, why are we telling people that this stuff is safe, when -we- know that it is not?
1. The internet will have to balkanized into those countries that have laws to go after hackers and those who do not.
2. Consumers will eventually only choose content that is actually hosted by their ISPs because that will be the only content that is safe.
3. ISPs will increasingly look to disallow traffic coming from "non-trusted" ISPs in order to protect themselves.
Verisign say it's hype - pardon me while I barf (Score:5, Insightful)
Here we should point out that Verisign are the pig-fuckers who stopped returning NXDOMAIN for .com in favour of their own search page and should never be trusted to say anything sensible about DNS.
Well, Mr Silva, it IS a way to misdirect them to a wrong site.
Power Point Presentation? (Score:5, Funny)
WTF? What geek or nerd would even read a PPP, much less trust anything in it?
And is it even possible to transfer actual information via Power Point? I've heard rumors that it can be done, but I don't think I've ever seen anyone actually do it.
Weakness of "domain control only validated" certs (Score:5, Interesting)
Kaminsky makes a point about how this bug can be used to spoof Certification Authorities who issue SSL certificates. For the cheap "domain control only validated" certificates, ownership of the domain is validated by sending an e-mail to the domain. If you can spoof DNS from the viewpoint of a CA, you can buy a valid SSL cert for a domain you don't own. Now you can spoof some banking site, and the spoofed site will properly display an SSL cert.
He also makes the point that DNS cache poisoning can be used to fake MX records in DNS, which will result in e-mail being diverted to the attacker, who can then look at it. If the attacker creates a high-priority MX record, they can read the mail, then disconnect without acknowledging receipt. The originating mailer will then resend to the next-priority MX record, the real one. So the mail reaches its destination without anything in the headers to indicate it was snooped.
Re:Don't believe the hype! (Score:5, Funny)
That's so last century. Here, let me fix it for you:
Parent