What Could You Do With a Bogus Root Name Server?

Barlaam notes a post from the Renesys Blog which follows up on news they discussed a couple weeks ago about the 'identity theft' of a root name server. To emphasize the issue of safeguarding such a system, they've now posted an explanation of exactly how the situation could be exploited. "It shouldn't be too hard to see that you could end up answering every DNS query from an organization that came to you for an updated list of root name servers. Every one. And you might end up doing this for a very long time, especially if your answers were largely correct. An attack like this would have no resemblance to the YouTube hijack, where the entire planet gets a blank page and it's immediately apparent that something isn't right. Obvious events like this will continue to occur, and we'll continue to resolve them relatively quickly. But as this incident demonstrates, DNS hijacks are far less obvious and potentially far more harmful."

Comments

Simple recipe

[canuck57]

If you have lost DNS, game is over, you lose. A recipe if your system hits a compromised root server.

• You open up email to read todays email. You PC looks up pop3.yourisp.com.
• DNS returns the IP of evil PC to your PC which will connect to it.
• Next, evil PC will emulate your login, IP address and record the password. Could even be a /. password.
• Evil pc now has the info needed to read/retrieve your email.

Better yet, people often use similar IDs and passwords into other systems. Evil hackers can often use the email to figure out which banks, credit, stock brokers and on line e-tailers you use. Maybe change the home address of your Amazon account and order stuff, if the e-tailor isn't right on top of it.

Root servers need to be secure, end of story.

I should note the above method would also work with SSL, be creative, it only has to be a legitimate cert with a root chain.