Slashdot Mirror
Identity Theft Hits the Root Name Servers
aos101 writes "The Renesys blog has an interesting story about networks advertising the old address space of the L root name server after ICANN changed the IP address last November. These networks were also running root name servers on the old IP address of the L root name server up until last week, so any DNS servers still using the old IP address might have been getting their answers from these bogus name servers. A very cursory examination by Renesys of one of these bogus servers found that it appeared to be providing correct responses, which might be why no one noticed the problem. As Renesys points out, the volume of traffic to a root server is staggering, so the people running these bogus root servers must have had a reason. What did they get out of it?"
Somehow, I doubt that is the explanation, but wouldn't it be nice if it were true?
Invenio via vel creo
They were probably running something similar to Verisign's SiteFinder that attempts to cash in on typos and non-registered domains.
statistics? profiling?
that data would be worth something to ad men surely...
Actually, "attack" isn't really an appropriate term. It was not really an attack or a hijack or even identity theft. For one thing, these terms imply the existence of both a victim and a villain. In this story, the villains are not obvious and there might not have been any victims.
How do we go from this to a headline reading Identity Theft Hits the Root Servers?
There is no reason to believe that it was malicious at all. We all are familiar with that black hat turned grey or white that wants to help out by demonstrating vulnerabilities in the system. That is just as plausible as anything else. Maybe it's the free-masons!! The Illumanati, maybe!!! The only certain thing about this is the need to secure name service. We should be glad even though it was compromised, there is no apparent damage done.
I got a catholic block.
If only 5% of DNS servers hadn't updated their root servers list, and this server is listed as 1 of the 13 root servers, then these people will have .38% of the entire internet's DNS requests coming through them.
With "control" of a root server (or at least what a DNS client believed was a root server. They would be free to insert whatever records for anything they want. Think banking, finance, email, etc.
So really, the title of this article should have been if you were in organized crime, what would you do if you could transparent MITM (man in the middle) attack .38% of all web traffic on the internet.
My guess is all your accounts belong to us.....
Colin McNamara - CCIE #18233 "The difficult we do immediately, the impossible just takes a little longer"
If they did not answer the name requests then the client would go on retriying and retrying, being a more effective DOS on thier network. So the only correct action was to put a DNS server on the announced DNS adresses.
The problem is, if you do grab the hints file from there, you have to make sure you keep refreshing it to stay up to date... Otherwise you're just setting yourself up for the same attack the next time this happens...
That said, I don't know if trusting your upstream provider is any better...
"Go to CNN [for a] spell-checked, fact-checked summary" -- CmdrTaco
My uncle used to say that he preferred corrupt judges to incompetent judges, since the corrupt judges would be careful to get things right 95% of the time, so that they would be well placed when the time came to undermine the system. The incompetent judges, on the other hand, would screw things up far more frequently than that, and ruin far more lives than the corrupt judges. A very few redirected queries could get lost in the huge number of correct responses, but still provide big benefits to a criminal. And if they compromised a secretive bank, or the Defense Department, it's unlikely that we would ever hear about it.
How will anyone else know, since it's the root system responsible for giving out IP addresses?
Example: I request www.google.com. Parent doesn't know, its parent doesn't know, blah blah blah until I go to the "root hints" which are hard-coded IP addresses. There I look up www.google.com, and get my IP address. Now if that root server has a different IP, how the hell do I find it?
Is this a catch-22 or what?
why traffic goes to "retired" address space is a difficult question to answer. http://www.caida.org/workshops/wide/0611/ has a pointer to some early work done on the "B" renumbering. There was agreement by the operators of "B","L","J", and "M" to collect data during the DITL-2008 collection to see if any correlation btwn querying nodes. That said, ICANN should have renumbered the node when they took it over. They did not. They have not had permission to use the prefix since 2004 - but for stability sake, I did not make a big fuss.
bill manning
Maybe the reason that the nameserver is providing correct responses is due to something like port-knocking for domain names?
If a phisher wanted to use this, they would only supply a bogus dns pointer to a query if the query was preceded by some 'primer' query. E.g. first someone tries to resolve alpha.com, then beta.com within a few seconds, only then will the root server give the incorrect response for beta.com. This would be pretty easy to do with some cross-site scripting magic.
You can never disprove a conspiracy, after all...
The Right Reverend K. Reid Wightman,
The Internet was originally designed to be a "self-healing" system, able to route around damage like (no joke) a nuclear war.
However, the system as it currently exists has one SERIOUS flaw: the reliance on root servers.
We need to switch to a system that does not rely on root servers. There are at least several such systems that are workable. Yes, the U.S. government would lose control over the whole thing. Does ANYBODY in their right mind think that is a bad thing? As long as nobody else can gain root control either, and there are various schemes that can ensure that.