Slashdot Mirror
Kaminsky's DNS Attack Disclosed, Then Pulled
An anonymous reader writes "Reverse engineering expert Halver Flake has recently mused on Dan Kaminsky's DNS vulnerability. Apparently his musings were close enough to the mark to cause one of the Matasano team, who apparently already knew of the attack, to publish the details on the Matasano blog in a post entitled 'Reliable DNS Forgery in 2008.' The blog post has since been pulled, but evidence of it exists on Google and elsewhere. It appears only a matter of time now before the full details leak."
Reader Time out contributes a link to coverage on ZDNet as well.
Kinda makes you wonder what they're getting out of it.
How we know is more important than what we know.
...about these Monsanto DNA attacks for some time...
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
Q: Why is starting a post in the Subject: line annoying?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
Doxpara.com, the blog of Dan Kaminsky who first discovered the vulnerability, has also been updated.
In case of Slashdotting, here's the full update;
Patch. Today. Now. Yes, stay late. Yes, forward to OpenDNS if you have to. (Theyâ(TM)re ready for your traffic.) Thank you to the many of you who already have.
I got this much and am working on extracting more but hitting a roadblock.
Matasano Chargen  Blog Archive  Reliable DNS Forgery in 2008: Kaminskyâ(TM)s Discovery. Well the cat is finally out of the bag. I suspected this was how the
the cat is out of the bag. Yes, Halvar Flake figured out the flaw Dan ... One of them involves mucking about with the QID in DNS packets and
and the other requires you to know the Deep Magic. First, QIDs
Bobâ(TM)s a resolver and Alice is a content DNS server. Bob asks Alice for the address of WWW.VICTIM.COM. The answer is 1.2.3.4.
Mallory would like the answer to be 6.6.6.0. It is a (now not) secret shame of mine
that for a great deal of my career, creating and sending packets was, to me, Deep Magic. Then it became part of my
job, and I learned that it is surprisingly trivial. So put aside the idea that forging IP packets is the hard part
of poisoning DNS. If Iâ(TM)m Mallory and Iâ(TM)m attacking Bob, how can he distinguish my packets
from Aliceâ(TM)s? Because I canâ(TM)t see the QID in his request, and the QID in my response
wonâ(TM)t match. The QID is the only thing protecting the DNS from
Mallory (me). QID attacks began in the olden days, when BIND simply incremented the QID
with every query response. If you can remember 1995,
hereâ(TM)s a workable DNS attack. Think fast: 9372 + 1. Did you get 9372, or even miss and get 9373?
You win, Alice loses. Mallory sends a constant stream of DNS responses for WWW.VICTIM.COM.
All are quietly discarded â"- until Mallory gets Bob to query for
WWW.VICTIM.COM. If Malloryâ(TM)s response gets to your computer before the
legitimate response arrives from your ISPâ(TM)s name server, you will be redirected where
where Mallory tells you youâ(TM)re going
Support my political activism on Patreon.
From reading the f'ing article, I now know that I should never try to resolve WWW.VICTIM.COM.
Sleep your way to a whiter smile...date a dentist!
I still have it in my RSS reader. I sent the others in my security group the link referenced in the feed, but it ended up with a 404 page. I thought it was a blip on their server, but now I see they retracted the post. It's a bit late for that, as I'm sure I'm not the only one who subscribes to their blog.
Just another example of how you can't erase knowledge once it's been disseminated.
BTW, the method of attack really is quite clever. And pretty trivial.
"This calls for a very special blend of psychology and extreme violence" - Vyvyan "The Young Ones"
Ok, here's the gist: It's difficult to spoof a response for the right domain name, because of the random query IDs. You need too many requests and caching servers don't usually ask for the same name very often. But it's easy to get a caching server to ask for many different names in a subdomain, so do that and send your fake answers. One of them is going to get accepted sooner or later. Include spoofed glue for the real subdomain (www...) in your answers. Because the glue is for the same domain, it is accepted. Tadaa, poisoned DNS.
Use Google search snippets to expose little details of the document...
I'm guessing some persistent folks will eventually be able to piece the bits together.
i.e. see how much you can piece together from the summary with the result shown by google. Adjust your search by including unique words towards the end of the snippet in one search to try to get the text that follows.
1
2
21 Jul 2008 ... One of them involves mucking about with the QID in DNS packets and the ... The QID is the only thing protecting the DNS from Mallory (me). ...
21 Jul 2008 ... If Mallory wins, the next 10000 or so people that ask that cache where WWW.VICTIM.COM is go to 6.6.6.0. 3. Then thereâ(TM)s that other set of ...
21 Jul 2008 ... Then thereâ(TM)s that other set of DNS vulnerabilities. ... Then letâ(TM)s set up an evil server with it, and register it as EVIL.COM. ...
21 Jul 2008 ... EVIL.COM, and watch how the QIDs bounce around; eventually, sheâ(TM)ll break the .... EVIL.COM and slipping strychnine into his ham sandwich, ...
21 Jul 2008 ... This will be Bobâ(TM)s unique identifier for his sandwich acquisition transaction. Note that the number will probably be used twice â" once when ...
21 Jul 2008 ... Which sends back a response with an unexpected (evil) Additional RR. ... Weâ(TM)ll come back to it. Alice has an advantage in the race, ...
21 Jul 2008 ... Alice has an advantage in the race, and so she likely beats Mallory. NXDOMAIN for AAAAA.VICTIM.COM. Aliceâ(TM)s advantage is not insurmountable. ...
21 Jul 2008 ... Aliceâ(TM)s advantage is not insurmountable. Mallory repeats with AAAAB.VICTIM.COM. Then AAAAC.VICTIM.COM. And so on. ..
21 Jul 2008 ... Frequently, that server has to go ask another, and so on. .... And so on. Sometime, perhaps around CXOPQ.VICTIM.COM, Mallory wins! ...
21 Jul 2008 ... If Mallory wins, the next 10000 or so people that ask that cache where WWW .... COM, Mallory wins! Bob believes CXOPQ.VICTIM.COM is 6.6.6.0! ...
21 Jul 2008 ... Poisoning CXOPQ.VICTIM.COM is not super valuable to Mallory. ... Because her response didnâ(TM)t just say CXOPQ.VICTIM.COM was 6.6.6.0. ...
21 Jul 2008 ... COM was: 6.6.6.0. Every resolver that points to that name server will now ... COM to 6.6.6.0. Those records are in-bailiwick: Bob is in fact ...
Well, as soon as he had posted that thing he got a Cease & Desist letter from MPAA for disclosing the intellectual property of Wachowski Brothers for The Matrix: Rebuttal. The movie was supposed to answer all the questions pertaining to the first movie and this attack was the secret way that Zion crafts used to hack into the Core. Of course, the Core refused to get its DNS servers patched because they didn't need anyone's help.
I've had enough. From now on, /. isn't /. for me. It's 216.34.181.45. I'm updating all my bookmarks.
Wait, why is it redirecting? I have a bad feeling about this. Itsatrick.
...is not just that you can race legit DNS servers for legit queries, is that you can request recursive resolution for bullshit DNS servers, while submitting fake answers WITH malicious informational records that let you poison second-level domains. So by requesting xxjk3j.google.com while submitting your own coolly crafted answer, you can make the victim DNS use YOUR DNS as authoritative for the future google.com replies.
THAT is the significance of the attack. THAT is what matasano pulled.
Rudd-O - http://rudd-o.com/
If this is the real deal, there's some bogosity here. This is certainly not a new attack or flaw in the dns protocol, any more than run of the mill dns cache poisoning is. Spoofing responses from the root servers (to hijack a TLD) is difficult; their TTLs are long, there are many of them (more unpredictability), and most DNS servers service so many requests that it's unlikely that your spoofed answer will be the first one to hit the server and thus poison the cache once the TTL for that TLD has expired. Spoofing responses from TLD servers is standard issue cache poisoning, and you cannot use it (any more) to poison a cache with an irrelevant record; BIND is going to ignore any NS, A, SOA, or other records for bankofamerica.com. in the additional or authoritative sections if the request was for some-domain-that-don't-exist.com. I'm back to where I was before; not seeing anything new here except a clever theoretical attack that would work much better if the TTLs for the TLD servers were on the order of minutes or hours rather than days. Either Halver guessed wrong, or the security community has been mislead about the severity of the issue.
This isn't even close to the same attack. Newer DNS server have randomized query IDs, so spoofing DNS packets isn't nearly as trivial as it used to be. This attack appears to combine the birthday paradox attack strategy (sending lots of queries and replies so the probability of a spoofed QID matching is much higher) with adding resource records for the actual name you want to poison (under the same domain).
This is sad.
Rudd-O - http://rudd-o.com/
The responsible thing at this point would be for the vulnerability to be published. By now the bad guys surely already have the details and are in the process of selling exploit code to each other.
While the pro-security community is being left in the dark.
He may have considered new modes of attacks that had not yet been concerns.
For example... phishing wasn't such an issue back in the earlier 1990s when the original weakness was noted.
A DNS hijacker attempts to poison a particular domain on a DNS cache. That's the ordinary attack model a DNS server admin would be concerned about, right?
What if instead, the attacker doesn't care what domain they poison? Instead, they aim to attack major ISPs' DNS cache, or authoritative DNS servers' cache.
Instead of trying to poison one particular domain, they go down a HUGE dictionary of popular domain names, TLDs, etc.
And if their odds of each poison being successful are (1/2^16) based on being able to predict the source port?
They have a good chance of eventual success, by brute force, especially if they can reduce the search space for transaction id, or re-use a legitimate transaction id in an unexpected way.
The attacker doesn't care that his spoofed packets will be wrong or won't get there first for most domains.
Poisoning _just one_ popular domain with a bogus NS record may be a serious attack.
Once one poison is successful, if the future dns transaction ids/source ports are sequential, or even just pseudorandom, an attacker can possibly know that they have succeeded (By testing the success of their poison).
Knowing that they succeeded gives them the state of the RNG; they might also get that querying a domain whose authoritative DNS server is complicit to the attack (and will provide the attacker with the DNS request packet for analysis)
The pro-security community has always been safe; DJBDNS and derivatives are immune to this attack and always have been.
Use djbdns which is immune to this attack. Dan Bernstein actually described this in 2002 http://cr.yp.to/djbdns/res-disaster.html
djbdns is not prefect but has been better than BIND which had it large share of bugs and security problems.
You don't need the address for the NS server as you're getting a result already. If you didn't ask for the information then it shouldn't be in the reply - if it is just discard the entire packet as bogus and keep listening for the real one.
Mod parent down for not understanding the vulnerability.
That is different - that's just advertising and silliness off the way the wildcard matching works for WHOIS.
The issue is when you can force the target to resolve blah.google.com to poison www.google.com and then include a glue response for www. in with the blah. response which is then accepted because the domains match at to the right of that level.
... it ended up with a 404 page. I thought it was a blip on their server, but now I see they retracted the post.
They fail. If they've removed it with no intention of making it available again it should be 410 Gone, not 404 Not Found. Am I the only person who reads the HTTP spec? It's not exactly hard to understand...
Using HTML in email is like putting sound effects on your phone calls. Just say <strong>no</strong>.
Alright, so I'm not even someone who does DNS/networking stuff even for a hobby (just a math grad who skimmed the RFCs once or twice) so if I can figure this out from what's up now then any competent bad guy can as well.
Anyway my guess is that it involves a combination of the birthday attack and the request for multiple nonexistant nameservers. That is as the attacker you trick poisontarget.com into trying to resolve the following locations.
AAA.google.com ....
AAB.google.com
XXX.google.com
Now you forge a single response packet that works for all of these requests and send many different copies with different TXIDs. Thus to succeed you need only hit ONE of the TXIDs used in the real requests.
In these forged responses you also have a forged glue record (as suggested in some of the links) which gives you control of lookups for all of google.com at poisiontarget.com after a single success.
Then again maybe I missed something basic which means this doesn't work.
If you liked this thought maybe you would find my blog nice too:
There will be more (new) announcements in the coming week or two. The DNS is gonna be fun for a while, unfortunately. We prefer it to be reliable and accurate.
# Hack the planet, it's important.
y ecopeland
0.
The cat is out of the bag. Yes, Halvar Flake figured out the flaw Dan Kaminsky will announce at Black Hat.
1.
Pretend for the moment that you know only the basic function of DNS -- that it translates WWW.VICTIM.COM into 1.2.3.4. The code that does this is called a resolver. Each time the resolver contacts the DNS to translate names to addresses, it creates a packet called a query. The exchange of packets is called a transaction. Since the number of packets flying about on the internet requires scientific notation to express, you can imagine there has to be some way of not mixing them up.
Bob goes to to a deli, to get a sandwich. Bob walks up to the counter, takes a pointy ticket from a round red dispenser. The ticket has a number on it. This will be Bob's unique identifier for his sandwich acquisition transaction. Note that the number will probably be used twice -- once when he is called to the counter to place his order and again when he's called back to get his sandwich. If you're wondering, Bob likes ham on rye with no onions.
If you've got this, you have the concept of transaction IDs, which are numbers assigned to keep different transactions in order. Conveniently, the first sixteen bits of a DNS packet is just such a unique identifier. It's called a query id (QID). And with the efficiency of the deli, the QID is used for multiple transactions.
2.
Until very recently, there were two basic classes of DNS vulnerabilities. One of them involves mucking about with the QID in DNS packets and the other requires you to know the Deep Magic.
First, QIDs.
Bob's a resolver and Alice is a content DNS server. Bob asks Alice for the address of WWW.VICTIM.COM. The answer is 1.2.3.4. Mallory would like the answer to be 6.6.6.0.
It is a (now not) secret shame of mine that for a great deal of my career, creating and sending packets was, to me, Deep Magic. Then it became part of my job, and I learned that it is surprisingly trivial. So put aside the idea that forging IP packets is the hard part of poisoning DNS. If I'm Mallory and I'm attacking Bob, how can he distinguish my packets from Alice's? Because I can't see the QID in his request, and the QID in my response won't match. The QID is the only thing protecting the DNS from Mallory (me).
QID attacks began in the olden days, when BIND simply incremented the QID with every query response. If you can remember 1995, here's a workable DNS attack. Think fast: 9372 + 1. Did you get 9372, or even miss and get 9373? You win, Alice loses. Mallory sends a constant stream of DNS responses for WWW.VICTIM.COM. All are quietly discarded --- until Mallory gets Bob to query for WWW.VICTIM.COM. If Mallory's response gets to your computer before the legitimate response arrives from your ISP's name server, you will be redirected where Mallory tells you you're going.
Obvious fix: you want the QID be randomly generated. Now Alice and Mallory are in a race. Alice sees Bob's request and knows the QID. Mallory has to guess it. The first one to land a packet with the correct QID wins. Randomized QIDs give Alice a big advantage in this race.
But there's a bunch more problems here:
*
If you convince Bob to ask Alice the same question 1000 times all at once, and Bob uses a different QID for each packet, you made the race 1000 times easier for Mallory to win.
*
If Bob uses a crappy random number generator, Mallory can get Bob to ask for names she controls, like WWW.EVIL.COM, and watch how the QIDs bounce around; eventually, she'll break the RNG and be able to predict its outputs.
*
16 bits just isn't big enough to provide real security at the traffic rates we deal with in 2008.
Your computer's resolver is probably a stub. Which means it won't really save the response. You
According to the "confirmed" post by Thomas Dullien aka Halvar Flake (found via this PCWorld article), the problem might be even simpler than that. He issues requests for some non-existent domain in .com, instead of a non-existent subdomain in the domain you're attacking.
Can anyone confirm, or must it be subdomains?
See http://thefrozenfire.com/data/dnspoisoning.html for the whole deal, without the pastebin RAW formatting ;)
An answer may be to use the glue to perform any lookup that can use it as part of that query, but never allow the glue itself to create a cached DNS entry; i.e. to have a life outside that lookup.
Except perhaps caching would be ok, if the cached result can be re-used _only_ when repeating the very same lookup that yielded the glue, the populated additional section.
This approach segments the returned additional section from the rest of the zone (helps constrain the poison to the one subdomain)
I've posted up the full text of the article, and it'll stay up, assuming lighty doesn't fail miserably on me. http://www.jbip.net/content/text-mantasanos-article-detais-kaminskys-dns-attack
Just because it has "security" in the name, doesn't make it secure, Alice.
The patches make it clear that ADDITIONAL-section processing is to blame- just as it has been numerous times over the last twenty or so years. DJBDNS doesn't do ADDITIONAL-section processing and so it immune. BIND tries to do a lot of hand-waving to continue doing ADDITIONAL-section processing even though it's clearly a bad idea- in order to protect egos.
So the guy who rejects advise from the security community on src port randomization and ADDITIONAL-section handling; the guy who has had countless vulnerabilities, and the very same guy who has lied about BIND8 and BIND9's complete rewrites, that's the guy you're taking at his word regarding the security of DNSSEC?
By the way, DJBDNS supports all RR types- including those that haven't been invented yet, simply because it has an extensible data format.
Actually you have the answer within your own post. As you said "If they've removed it with no intention of making it available again". According to the spec "If the server does not know, or has no facility to determine, whether or not the condition is permanent, the status code 404 (Not Found) SHOULD be used instead." It is quite possible that the page was only taken down temporarily, with the intent to restore it on the official disclosure date. So use of code 410 which would be in violation of the spec, and 404 the proper reply code.
Tag: geek humor
-
- - You can't take something off the Internet! That's like trying to take pee out of a swimming pool.
Interesting you say that. Whenever I get mod points, the subject line is one of the things I look at to see where to grant my mod points.
Reading every posting to see which ones are worth modding up would be too much work. I look for replies in a thread where the author has taken the effort to change the subject line from "Re:Re:Re:Re:Unoriginal First comment" to something relevant; these have a much higher chance of being insightful or interesting. The more concise and pithy the subject, the more I make sure I click on it to read; a subject line like "Not true: ABC is counterexample" conveys more information than "You're wrong!" and is correspondingly more likely to be modded up.
I'm not saying that a catchy subject line is enough to get mod points from me, but those are the ones I will read first.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
Okay, I don't dabble deep in DNS but I have a few quick questions. The RR thing is nasty because sub-domain authority implies domain authority. That's just silly and I'm stunned that something so simple is still true. I imagine there are a million and one "good" reasons for it, but it appears to be a gaping hole that could easily have been removed.
However, on the "let's spoof a DNS response" front - if a DNS server/client is being sent lots of spoof reponses, how long until they are picked up by a filter and blacklisted, tarpit'd or similar at the ISP end? This is the solution surely, even if you can send millions of packets with incorrect QID's and similar identifiers at a DNS server, like any other service at some point it has to say "you're trying to be naughty" and blacklist any packets, sound an alert, get the upstream filters to block such traffic etc. (This is, of course, assuming that there are at least some systems in place to stop or limit source-IP forgery in the first place). It might even be a good idea, at this point, for such servers to not trust their data, and constantly compare their copies with those available from the nameservers. If "fluctuation" of the data (between real and spoofed responses) is detected, then sound an alert on that domain.
How many responses does an average DNS server get that are invalid because of purely accidental causes (e.g. corrupted packets, mis-configured routers etc.)? Surely it's so few that it can instantly blacklist any suspicious activity, like trying to poison recursive caches in this manner.
I imagine that most home routers are extremely stupid and can't stop such things because they rely almost exclusively on the ISP's DNS servers to do their job and a flood of fake packets will not be picked up (this is, however, one of the reasons that I've always used "DMZ" or PPP half-bridge settings on ADSL routers to throw all external packets towards a real server rather than relying on some VxWorks firmware to handle IP-based attacks). But the servers? They *should* be filtering, cleansing and blacklisting packets even before you get into whether they have the most up-to-date patches, and a security fix to enhance the randomness of X etc.
It seems that the DNS servers are too trusting of "correct" packets that come as part of packet-floods of incoming data that is *obviously* false. DNS clients accepting data appearing to come from a trusted host is not nice, I agree, but recursive DNS servers should know better.
Or have I missed something incredibly obvious here?
I don't really care because my ISP wasn't vulnerable to this attack when I first tested it about 10 minutes after the first posting about its potential on the blog, and I'm pretty sure that they wouldn't have had any more advanced warning than anyone else.
Having said that, the DNS servers provided by LGfL's broadband supplier are, apparently, vulnerable. (London Grid for Learning, a London-wide schools extranet that virtually every London school, of which there are hundreds, use for their Internet connection, DNS servers, content filtering, etc. as well as their external content host). But, knowing LGfL and the way UK IT operations that are in any way involved with government work, that's not surprising at all.
Malory wants to poison the server ns.polya.com
Malory sends NS requests for ulam00001.com, ulam00002.com ... to ns.polya.com.
Malory then sends a forged answer from the .com server, saying that the NS for www.ulam00002.com is ns.google.com *AND* puts a glue record saying that ns.google.com is 66.6.6.6
Because the glue records corresponds with the answer record, (same domain) the targetted nameserver will cache or replace it's curent record of ns.google.com to be 66.6.6.6
Hmmm, can't be that simple, can it ?
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc