Slashdot Mirror
What Could You Do With a Bogus Root Name Server?
Barlaam notes a post from the Renesys Blog which follows up on news they discussed a couple weeks ago about the 'identity theft' of a root name server. To emphasize the issue of safeguarding such a system, they've now posted an explanation of exactly how the situation could be exploited.
"It shouldn't be too hard to see that you could end up answering every DNS query from an organization that came to you for an updated list of root name servers. Every one. And you might end up doing this for a very long time, especially if your answers were largely correct. An attack like this would have no resemblance to the YouTube hijack, where the entire planet gets a blank page and it's immediately apparent that something isn't right. Obvious events like this will continue to occur, and we'll continue to resolve them relatively quickly. But as this incident demonstrates, DNS hijacks are far less obvious and potentially far more harmful."
.. do what we do every night.. try to take over the world!!
.... You could be cashing in big time..... )
(Seriously, Imagine borrowing every bank's front page in North America
... so, you answer nearly all of them correctly.
Except for the precious few, which, say, redirect you to almost exact copies of pages which take your credit card data.
Or did I get it wrong?
Ignore this signature. By order.
i would redirect http://slashdot.org/ to http:///..org
yeah how funny is it now that the joke is on the other foot biatches!
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
... whereby you can actually "sign" digital data so that it's clear where it came from. If somehow they could incorporate that into this whole "DNS" system, maybe it would fix the problem?
Support microSD: in a post 9/11 world, it is unwise to carry your data on media that you cannot comfortably swallow.
If you have lost DNS, game is over, you lose. A recipe if your system hits a compromised root server.
Better yet, people often use similar IDs and passwords into other systems. Evil hackers can often use the email to figure out which banks, credit, stock brokers and on line e-tailers you use. Maybe change the home address of your Amazon account and order stuff, if the e-tailor isn't right on top of it.
Root servers need to be secure, end of story.
I should note the above method would also work with SSL, be creative, it only has to be a legitimate cert with a root chain.
Seriously, in the last decade the premise that the Net is always there has become a silent assumption underlying a lot of critical systems. No I'm not talking about nuclear power stations being online, I'm talking about basic logistics chain outages that mean there's no-one there to run the power station, because they've no fuel for their car, because the petrol tanker driver is off scavaging food for his kids. There are a number of scenarios that could knock out the net (or at least cause widespread depeering, so you'd be stuck on your provider's network and unable to get traffic to/from anywhere else); it would be... well, a bit too interesting for my liking to see how things would go with, say, a seven day outage. Actually a 7 day outage might be just enough to wake people up to the importance of patching your infrastructure, having a heterogenous mix of code for all critical functions, oh and and enforcing BGP security.
The solution is to maintain a series of flat-file or relational DBs locally for every host on the Internet. Periodically, you should be able to do an FTP or similar of the latest master file, and place it on your local nameservers or hosts. Its the only way to be sure.
I want to delete my account but Slashdot doesn't allow it.
It just doesn't scale. But you know that, don't you?
"Long run is a misleading guide to current affairs. In the long run we are all dead." (John Maynard Keynes)
Back in Febrary 2006 I wrote a note "What Could You Do With Your Own Root Server" at
http://www.cavebear.com/cbblog-archives/000232.html
My conclusions were that one could make money and cause trouble.
One of the more interesting aspects was (and still is) that one could operate root servers and, using the Google model, pay ISPs and users to send their queries to your roots so that you could generate data mining revenues.
That quality of data that is minded form root traffic would not be as good as that as from a top level domain server - and who has some large top level domains and also has root servers? Verisign.
And ICANN's contract with Verisign explicitly permits data mining of query traffic.
It's sad that DNSSEC hasn't gotten wider adoption given that the problem of spoofing is getting bigger.
Inventions have long since reached their limit, and I see no hope for further development.-- Frontinus, 1st cent. AD
Time for you mental midgets to start remembering IP addresses. Do your own damn cacheing.
It's a JOKE! Alright?
What?
Comment removed based on user account deletion
Comment removed based on user account deletion
Anything associated with the Bush Adminsitration and fundraising for Senator McCain would definitely be sent to some educational sites of my choosing. Government propaganda sites in China would also be re-directed to more educational sites. Sites for military contractors like Halliburton, Blackwater, Lockheed Martin, McDonland Douglass, and Northorp Gruman would be re-directed to sites that show war profiteering information and US General Sevices Administration no-bid or non-competitive contract abuses.
The world would be a much better place if I controlled its DNS servers. Now, when do I get prvileges on those root DNS servers?
216.34.181.48 www.slashdot.org
208.65.153.253 www.youtube.com
208.65.153.238 www.youtube.com
208.65.153.251 www.youtube.com
69.63.184.15 www.facebook.com
81.110.242.129 www.s5h.net
66.102.9.99 www.google.com
66.102.9.104 www.google.com
66.102.9.147 www.google.com
Use google page cache for anything else
Why UNIX?
1. Invest in sawdust futures. 2. Redirect everything to goatse.cx
World-wide Rickroll?
Interested in open source engine management for your Subaru?
That had its domain name stolen while I was in the interview, and the DNS from their office still seemed to function... so from their office they still got their site when they went to xxx.com, but from anywhere else it went to yyy.com
...and sell it to the Chinese government. The answer to all their desires... No, just kidding.
Sung to the tune of 'What'll we do with a drunken sailor'?
Goatse.cx lives!
Have gnu, will travel.
Long gone are the days of digital 'graffiti', its all about hard cash now.
:)
i'm sure that would be worth something to someone.. Perhaps even enough to afford that shiny new powerbook pro
---- Booth was a patriot ----
It's kind of funny that this actually happens at my company and it's called "security". For the most part, my company's DNS server returns the correct IP addresses. One day, though, after repeated problems with our instant messenger clients losing messages between us, we did some investigating and found that the DNS names for major IM providers like AOL and Yahoo were being rerouted to internal IP addresses. Sure, they had warned us that activities on the corporate network could be monitored, but this was extremely dubious in my opinion. And the only way we found out was because their proxy server couldn't handle all the traffic.
I'd find a way to trick MediaDefender into DoS'ing some sensitive and well monitored .gov or .mil facility, then watch them disappear from the planet, hopefully with serious and non-temporary consequences for the MAFIAA bastards behind them, too, maybe earning all of us some decent civil liberty guarantees in the process.
Failing that, I'd be content with seeing them DoS themselves or any of their parent companies every time they try to spray their shit on any other address.
Vacuum cleaners suck. Kings rule.
"What Could You Do With a Bogus Root Name Server?" Easy, slap it around and call it Suzy. Or possibly, put it in a sack and beat it senseless.
I can envision a public service campaign to alert people to the fragile state of our infrastructure. The best part: yeah, it features Cinderella. "You don't know what you got til it's gone."
If we change "what would YOU do" to "what to you think might be done":
A bogus root server could be coded to pay attention to the source of the query and only create illusions for targeted victims - serving normal information to everyone else.
With that capability you can perform man-in-the-middle attacks on the victim - directing his connection to your own forwarding-and-tapping-and/or-modifying servers whenever the victim is attempting to connect to an external domain and his own nameserver got the domain record from you. (And with that domain record in his nameserver cache you'll get ALL the connections he makes until he stops opening new ones long enough for the cache entry to time out. For his business partners this might be never.)
(As has been pointed out already: If you luck out and the victim comes to you for an update of the root server addresses, you've got him until there's manual intervention.)
Man in the middle beats the pants off spear phishing for corporate (or government/military) espionage. You get to inject yourself into the key exchanges of certain otherwise-secure protocols (and the conversations thereafter), getting hold of the cleartext in situations were cracking the key to read eavesdropped traffic would be impractical. You also get to modify the content on-the-fly.
The amount of mischief this enables is mind-boggling. (For starters: Stealing or reconstructing customer lists. Identifying competitors' bids in order to slightly underbid them. Obtaining other corporate secrets - with the partner with whom they're communicating taking the blame.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
I'd redirect all the adult domain names to websites about Jesus.
All your rootservers all belong to us!
Seriously. whitehouse.com from Microsoft.com
*.ru from *.gov
mail.*.kr frommail.*.com
p0ned!
Oh last one...
unopedia.org from Wikipedia.org!!!
C ja l8r!
Any ISP sysadm that I know (and I know at least one hundred of them) already played $DEITY with DNS answers via local DNS servers or even via transparent DNS caching. When you have 500k unsuspected citizens at your fingertips, its hard to resist the temptation.
You can:
1. Phish every amazon.com, yourbank.com, etc CC numbers;
2. Eavesdrop even SSL/TLS secured e-mails, bonus points looking for keyphrases like "is a god in the sack", "(my husband|my wife|\w+) can.{0,2}not (know|discover) about" and similars;
3. ???
4. profit!!
What about if each DNS-request had to pass a 2/3 to give a reply (possibly with a warning if you get a fail), this would triple the amount of DNS requests obviously, but if every major ISP etc had three groups of DNS (marked as A, B and C type), you could have one A-type from ISP1, one B-type from ISP2 and one C-type from ISP3.
:-)
Better yet, if they use different hardware/firmware on the different types, a zero-day exploit might not be able to take enough rootservers to fool the 2/3.
Obviously, with fast enough access, and as long as you can trust your closest nodes you could expand this from 2/3 to x/y returns.
But then agsin, I know nothing about routing
I'd hack comcast.net
So if you own
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks