What Could You Do With a Bogus Root Name Server? 120
Barlaam notes a post from the Renesys Blog which follows up on news they discussed a couple weeks ago about the 'identity theft' of a root name server. To emphasize the issue of safeguarding such a system, they've now posted an explanation of exactly how the situation could be exploited.
"It shouldn't be too hard to see that you could end up answering every DNS query from an organization that came to you for an updated list of root name servers. Every one. And you might end up doing this for a very long time, especially if your answers were largely correct. An attack like this would have no resemblance to the YouTube hijack, where the entire planet gets a blank page and it's immediately apparent that something isn't right. Obvious events like this will continue to occur, and we'll continue to resolve them relatively quickly. But as this incident demonstrates, DNS hijacks are far less obvious and potentially far more harmful."
Its simple... (Score:5, Funny)
(Seriously, Imagine borrowing every bank's front page in North America
Re: (Score:2)
What could you do with a bogus root name server
What could you do with a bogus root name server
Er'ly in the mornin'?
Re: (Score:2)
Re: (Score:2)
Impersonatewindowsupdate and serve up malware
Impersonatewindowsupdate and serve up malware
Impersonatewindowsupdate and serve up malware
Er'ly in the mornin'!
Re:Its simple... (Score:5, Funny)
Hmmm... (Score:2, Informative)
... so, you answer nearly all of them correctly.
Except for the precious few, which, say, redirect you to almost exact copies of pages which take your credit card data.
Or did I get it wrong?
Re:Hmmm... (Score:5, Funny)
Re: (Score:2)
Oh wait, that's also been done.
easy (Score:5, Funny)
yeah how funny is it now that the joke is on the other foot biatches!
Re: (Score:2)
Actually, I have a Firefox Smart Bookmark [cogentmetal.org] set up so that
Re: (Score:2)
Re: (Score:2)
Nope, typo.
Re: (Score:2)
Re: (Score:1)
I've heard of this new technology... (Score:3, Interesting)
Re:I've heard of this new technology... (Score:5, Interesting)
DNSSEC [dnssec.net] has gone through three (3) mutually incompatible specifications. The DNSSEC people are claiming that the last revision really really works, honest, gov, and that all that remains to be done is deploying it.
But they don't appear to be deploying it on their own servers [isc.org].
Re:I've heard of this new technology... (Score:5, Informative)
But they don't appear to be deploying it on their own servers [isc.org].
I've just checked -- and the ISC do sign their zone. Sorry for the mis-information.
Re: (Score:3, Informative)
The entire security of DNS as provided by DNSSEC is predicated on the ability to trace a secure delegation. The general theory of operation is that you'd preconfigure your resolver with cryptographic hashes of the root's public DNSKEY records. Then every time you wanted to do a secure lookup, you'd be
Re: (Score:1)
Re:I've heard of this new technology... (Score:5, Informative)
Re:I've heard of this new technology... (Score:4, Insightful)
You don't need to sign the requests, you need to sign the replies. And you only need to compute the signing once, and store the signed value.
DNSSEC computation load's minimal (Score:2)
Simple recipe (Score:5, Insightful)
If you have lost DNS, game is over, you lose. A recipe if your system hits a compromised root server.
Better yet, people often use similar IDs and passwords into other systems. Evil hackers can often use the email to figure out which banks, credit, stock brokers and on line e-tailers you use. Maybe change the home address of your Amazon account and order stuff, if the e-tailor isn't right on top of it.
Root servers need to be secure, end of story.
I should note the above method would also work with SSL, be creative, it only has to be a legitimate cert with a root chain.
Re:Simple recipe (Score:4, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
ISP can make so that pop3 only works from inside of there own network and force you to have a differnt web mail password not use the same login in system for web mail and pop3 mail.
While I can't per say get to pop3 proper from work, I can get tot he web mail server. Huge hacker advantage about web mail. It doesn't move the message so the real user will not notice missing mail. A little perl script, harvest in bulk.
No, I gave a high level view. I will not post the code to do it and spell it out for na-sayers. It can be done. Wireless to is a nice entry point. Send a proxy redirect... fun and games.
Re:Simple recipe (Score:5, Insightful)
Think about it.
Re: (Score:2)
Oh good god, that's just the tip of the iceberg. More likely would be to MitM some large corps' Outlook Web Access or other places where domain credentials are exposed (VPNs and the like.) Wait until you've got a domain admin's password. You now own that entire corp. Now rinse and repeat for government bodies. How hard do you think it would be for the proverbial well-motivated and resourced attacker to trigger off a war in such circumstances?
Think about it.
Yep, you got the idea. Yes, it works similarily for other ports/protocols as well as network routing devices too. Think, you could even proxy back the traffic to the intended site login transactions as they occur. This way the session even behave properly, abet perhaps a little slower for the hops the traffic makes.
Yes, I think about it, yes, if a sophisticated hacking group decided to go for a target, most are not remotely prepared for what will happen.
Re: (Score:1, Informative)
Absolutely not. Do you know anything about SSL?
The certificate has to be signed by a legitimate Certificate Authority, and be in the name of pop3.yourisp.com. Otherwise your email program says "Hey! I was expecting a certificate for pop3.yourisp.com, when I got a certificate for pop3.evilisp.com!".
Well, most email programs will. Even Outlook will do that.
You can mess up a lot with DNS.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Re:Simple recipe (Score:5, Informative)
If you have lost DNS, game is over, you lose. A recipe if your system hits a compromised root server.
Unless you happen to have SSL enabled pop or imap.
A (revised) recipe for an SSL enabled mail host:
* You open up email to read todays email. You PC looks up pop3.yourisp.com.
* DNS returns the IP of evil PC to your PC which will connect to it.
* Evil PC returns a forged SSL certfificate claiming to be pop3.yourisp.com
* Your email client brings up an error message saying there's something wrong with this certificate (self signed, etc)
* You hopefully get suspicious, (this never having happened before), and don't click through.
* Attack fails.
If you don't get suspicious, and just click OK, you're right. But the situation isn't quite as dire as you make it out to be. I'd never connect to a non-secure host for something like email.
Re: (Score:2)
Which email client brigns up an error message for a self-signed POP3 server certificate?
(Try it, you'll be surprised how many don't.)
Re: (Score:3, Informative)
Mail.app and Thunderbird, for two.
Mail's error message actually characterises a self-signed cert with language to the effect of, "Couldn't connect to the server because of an untrustworthy certificate." When this was reported to me by a non-technical user, they repeated only the first two words: Couldn't connect.
That's how things should be.
I'm hoping that Firefox's improved handling of self-signed certificates ge
Re: (Score:3, Informative)
Re: (Score:2)
Don't put too much faith in SSL. Read Bluecoat SSL visibility [bluecoat.com]. It works and decodes the SSL in the middle to inspect traffic. This is the good use of the technique. It is however more sophisticated than plain text protocols to pull off.
Re: (Score:2)
Re: (Score:2)
I was suspicious enough to delay clicking okay until I called the helpdesk, but it turns out, yes, they did mess with their cert, and it was legit.
Sad but true: People need their email more than they need security.
Re: (Score:1)
I play the TLS trump card.
Re: (Score:1, Redundant)
I respond with the "your web browser honors 50 billion different CAs by default, and getting an illicit certificate signed by a single one of them won't be difficult" card.
Re:Simple recipe (Score:5, Informative)
Re: (Score:2)
Good to know. And what if the user emailed it? Mind you, most will not. But point taken. Amazon then is ahead of the curve.
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:2, Insightful)
Instead of a MitM attack, would it be possible to do a "proxy-in-the-middle" attack?
* User opens up to read email/connect to their bank account/something secure.
* DNS returns IP of evil impersonator (EI) instead of Real Computer (RC).
* User requests connection from EI. EI transparently proxies that connection to RC, while listening for the password that authenticates the key exchange.
* Profit! Or would it be?
I can't imagine this kind of hole not already being covered, but it seems like it would be fe
Re: (Score:3, Informative)
See SPEKE [wikipedia.org], for instance, which is pretty much a Diffie-Hellman key exchange with the (fixed) generator constant replaced by a hash of the password. Snoo
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Well, the CN field on the legitimate cert would have to match the DNS FQDN name that the client looked up the server address with. Unless your POP3 client doesn't verify that x.509 CN matches the DNS FQDN, which would make its SSL support pointless. Even MS Outlook does that properly.
break everything (Score:4, Insightful)
Seriously, in the last decade the premise that the Net is always there has become a silent assumption underlying a lot of critical systems. No I'm not talking about nuclear power stations being online, I'm talking about basic logistics chain outages that mean there's no-one there to run the power station, because they've no fuel for their car, because the petrol tanker driver is off scavaging food for his kids. There are a number of scenarios that could knock out the net (or at least cause widespread depeering, so you'd be stuck on your provider's network and unable to get traffic to/from anywhere else); it would be... well, a bit too interesting for my liking to see how things would go with, say, a seven day outage. Actually a 7 day outage might be just enough to wake people up to the importance of patching your infrastructure, having a heterogenous mix of code for all critical functions, oh and and enforcing BGP security.
Re: (Score:2)
Maybe the geeks should go on strike.
No patches; no tech support; no maintenance -- until things are organized properly.
Re: (Score:2)
Re: (Score:1, Insightful)
THink about it, If they did they could bring a country to its knees with say a 7 day strike. People have become so dependent on things just working, and when they dont they call in the tech guy that they would be going crazy after 7 days.
Sure youve got that one guy in every department who is or thinks he is really good at computers, but how long unti
Re: (Score:1)
(Unions certainly did a great deal of good for workers rights in the United States, but many of the important gains they made became laws and many of them now serve to make it very difficult to get rid of dead weight, to the detriment of everybody, including other union members)
Re: (Score:1, Informative)
Re: (Score:2)
It would be more a professional body similar to those that govern the medical and law professions. They might have the resources to organise a strike but I think would pretty much always
Re: (Score:2, Funny)
That would be sweet...
*GO BACK TO THE BASEMENT, JOHNNY*
*OK MOM! - Oh God, can't even dream in peace anymore...*
Re: (Score:1, Insightful)
"But what can any of us do about it? Who is Linus Torvalds?"
- Stallman Shrugged.
Re: (Score:2)
Re: (Score:2)
And we can argue until the civilization collapses.
Lazy and malevolent, that's the ticket. ;)
Re: (Score:2)
Re:break everything (Score:5, Interesting)
Re:break everything (Score:5, Interesting)
Exactly. If you think the problem is bad now, wait until we've fixed it. (Arthur Kasspe). This should be the motto engraved on every Government departmental seal.
flat files (Score:2, Funny)
Re: (Score:3, Informative)
http://www.livinginternet.com/i/iw_dns_history.htm [livinginternet.com]
Re: (Score:2)
That's what he was referring to. It's called a joke, grasshopper.
they tried that (Score:3, Funny)
Re:they tried that (Score:5, Funny)
Hey, I oughta' write up an RFC on this
Wrote about this in Feb 2006 (Score:5, Informative)
http://www.cavebear.com/cbblog-archives/000232.html
My conclusions were that one could make money and cause trouble.
One of the more interesting aspects was (and still is) that one could operate root servers and, using the Google model, pay ISPs and users to send their queries to your roots so that you could generate data mining revenues.
That quality of data that is minded form root traffic would not be as good as that as from a top level domain server - and who has some large top level domains and also has root servers? Verisign.
And ICANN's contract with Verisign explicitly permits data mining of query traffic.
DNSSEC (Score:2)
The heck with DNS (Score:3, Funny)
It's a JOKE! Alright?
Re: (Score:2, Insightful)
Re: (Score:2)
Only after we switch to IPv6.
Re: (Score:1)
Target evil sites (Score:2)
Re: (Score:2)
Look up an anarchist/comedy/anti-establishment group called "The Yes Men". They pulled a magnificent prank on the World Trade Organization by putting up a web site that people who didn't read carefully would assume was theirs.
The slagging they gave the WTO was presented in such a fashion that those would would seek such a site out would be well into it before they realized they were being had.
Being able to redirect by controlling DNS servers could raise the bar quite a bit, and you can bet that the o
Re: (Score:2)
B
hosts file (Score:3, Informative)
208.65.153.253 www.youtube.com
208.65.153.238 www.youtube.com
208.65.153.251 www.youtube.com
69.63.184.15 www.facebook.com
81.110.242.129 www.s5h.net
66.102.9.99 www.google.com
66.102.9.104 www.google.com
66.102.9.147 www.google.com
Use google page cache for anything else
Re: (Score:2)
Re: (Score:1)
#!/usr/bin/perl
use strict;
use warnings;
use Net::DNS;
my %hosts;
sub lookup {
my $res = Net::DNS::Resolver->new;
my $query = $res->search( shift );
if ($query) {
foreach my $rr ($query->answer) {
next unless( $rr->type eq "A" );
return( $rr->address
Re: (Score:3, Funny)
use strict; use warnings; use Net::DNS; my %hosts; sub lookup { my $res = Net::DNS::Resolver->new;my $query = $res->search( shift );if ($query) {foreach my $rr ($query->answer) {next unless( $rr->type eq "A" );return( $rr->address );}}else {warn "query failed: ", $res->errorstring, "\n";}}while( my $l = ) {if( $l =~ m!(http://.+?)\s! ) {print( "$1\n" );if( $1 =~ m!http://(.*?)/! ) {my $ip = loo
Profit! (Score:1, Funny)
That's easy (Score:5, Informative)
Take it... (Score:2, Insightful)
Obvious first move (Score:5, Funny)
Re: (Score:1)
http://web.archive.org/web/19991012153204/http://goatse.cx/ [archive.org]
Make some fast cash. (Score:2)
i'm sure that would be worth something to someone.. Perhaps even enough to afford that shiny new powerbook pro
Media Defender (Score:2)
Failing that, I'd be content with seeing them DoS themselves or any of their parent companies every time they try to spray their shit on any other address.
Re: (Score:1)
Point every single domain name on the planet to mediadefender's servers. Not only would it make every router within 8 hops burst into flames, the banks would be out for their blood too.
Would a 42U loaded rack even fit in a longboat? (Score:1)
Corporate Espionage via Man in the Middle (Score:2)
A bogus root server could be coded to pay attention to the source of the query and only create illusions for targeted victims - serving normal information to everyone else.
With that capability you can perform man-in-the-middle attacks on the victim - directing his connection to your own forwarding-and-tapping-and/or-modifying servers whenever the victim is attempting to connect to an external domain and his own nameserver got the domain r
I'd Do the Lord's Work (Score:1)
Re: (Score:1, Informative)
That is because DNS replies are typically cached for a period of time, often several days.
If you don't have it in cache, you go to the source and get the current value.
Re: (Score:2, Informative)
So if the web server was an internal server:
www.example.com -> 192.168.1.123 (returned by internal DNS server)
www.example.com -> 123.87.32.245 (returned by external public DN
Re: (Score:2)
I wouldn't say anything on corporate IM that I had a problem with my boss reading. I know most IT people don't sit around reading people's IMs for the hell of it, but if you assume they do, you just might stay out of trouble.