Slashdot Mirror
DNS Attack Writer a Victim of His Own Creation
BobB writes "HD Moore has been owned. Moore, the creator of the popular Metasploit hacking toolkit, has become the victim of a computer attack. It happened on Tuesday morning, when Moore's company, BreakingPoint, had some of its Internet traffic redirected to a fake Google page that was being run by a scammer. According to Moore, the hacker was able to do this by launching what's known as a cache poisoning attack on a DNS server on AT&T's network that was serving the Austin, Texas, area. One of BreakingPoint's servers was forwarding DNS (Domain Name System) traffic to the AT&T server, so when it was compromised, so was HD Moore's company."
I wonder if, when he got attacked, he just leaned back in his big leather chair, and chuckled, "Well played, sir, well played."
Proof that Karma is real baby!
Eviscerate the Proletariat!
Karma takes a break occasionally, but seems to have been alert when it saw this opportunity!!!
Bravo!!!!!!!
Ahhh just like the old Dutch saying: "Wie een kuil graaft voor een ander, valt er zelf in"
English: He who digs a pit for someone else, will fall in it himself
I predict another one of those raps about how lame this guy was and how "it can't possibly happen to us"...
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
The reporter has published a correction, which is also reflected on the Metasploit Blog.
Huh???
Your it.
Well, all I can say is, no one, not even him can prevent this shit from happening if a server out of their control such as this is unpatched. He should give at&t hell. All the other big ones like comcast and verizon claim to be fully patched. I understand the size of at&t's network but this is no excuse when everyone uses your network and pays good money for it.
Serves him right.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
but with less pissed off villagers and torches.
what goes around, comes around.
Since the attack wasn't on BreakingPoint, but rather than upstream DNS server, he pretty much just got swept up in the dragnet. These kind of attacks seem scarier than a direct attack, since you can do "everything right" with regard to patching, updating, firewalling, etc, and still get owned.
"Can't you see that everyone is buying station wagons?"
Yeah, that's what I said. He didn't pwn himself, he was pwned by someone using a tool he himself wrote. Two different things.
My blog
http://www.pcworld.com/businesscenter/article/149136/dns_attack_writer_a_victim_of_his_own_creation.html
This is real irony. So, if someone tags this story "irony", he would be correct.
Knowledge is power. Knowledge shared is power lost.
For tis the sport to have the engineer hoist with his own petard.
It's interesting to see how widespread this exploit has become. I've checked my home and office connections using Dan Kaminsky's handy DNS Checker and it appears that my ISPs have taken measures to avoid this problem.
Unfortunately, I also travel a good deal for work, and it's hard to be sure that the ISP used by whatever-hotel-I'm-staying-at-this-week will be as proactive.
The guys in TFA got pwned by being redirected to a bogus Google look-alike page. As I understand it, this kind of attack would be noticeable when attempting to use a secure (HTTPS) web connection, because the browser should throw up a certificate error. Is this true? What other ways might be used to detect this problem?
Yeah.. it'd be more like the US getting attacked by weapons they made and sold to Iraq or something... oh hang on..
...but how do I know this is really Slashdot?
Before this DNS thingie, I'd have said no. But I guess I'll be keeping my fingers crossed from now on.
In Soviet Russia your hacking toolkit owns you.
America, Home of the Brave.
Especially if you yourself made it.
No mod points, no meta-moderating/Firehose/all the other free work Slashdot wants me to do.
This DNS test is much better. https://www.dns-oarc.net/oarc/services/dnsentropy
Las Vegas is the ghetto? Good to know. Here I thought it was a bunch of really swank casinos and hotels in the middle of the desert.
P.S. We all know that you are actually one of the "suburban white kids who see this shit and think it is cool". So get off the computer before mom finds out you were using it during little Timmy's allotted time, and grounds your ass again.
The problem is that bad DNS responses should not be a source of vulnerability. Anytime there is traffic outside of your trusted domain, the identity of the remote system should not be trusted without a secure connection. There is work on Secure DNS, but I think it is better just to consider DNS unreliable, especially since wireless access points are common, and can give you whatever DNS they want. Even if you use another DNS server, it is easy enough to override it at the router. Unencrypted traffic should always be considered untrusted and prone to hacking. We need a system of secondary (tertiary, etc?) certificate signing so that every web site doesn't have to pay for a commercially signed certificate. That is more efficient and reliable than Secure DNS. (Right?)
Sure this was a real attack, and not a "jurassic duck" incident where he forwarded his own traffic to garner publicity?
http://www.youtube.com/watch?v=_hnylJ2scVU
Now is this what they call "eating one's own dog food"?
I am not really here right now.
We have a nice BIND DNS scanner here check your networks today. www highlogic net
Actually, it's supported by a much larger, poorer city than you'd guess from looking at the Strip. The casino hotels are largely run by people who could never afford to stay in them.
Talk to one of the illegal Mexicans who have to loiter street-level handing out callgirl cards. They can tell you about the real LV experience.
DRM: Terminator crops for your mind!
weird. i live in austin, and at work tuesday morning gmail gave me an SSL error on all the macs on our network (it worked on the one pc and if i switched to the neighbor's wireless on the mac). then google.com started redirecting to host252.hostmonster.com/somethingorother telling me the account has been suspended. we had to get AT&T to reset something on their end...
any chance that's related?
This is just Dan's way of showing disapproval of H.D.'s haste to release the point-and-click exploit.
This is correct. Thee is an object, and thou is only a subject.
Comment removed based on user account deletion
Comment removed based on user account deletion
youtube link.
I have no idea what AT&T's network is like, but this affected us in San Antonio as well. But there are approximatly 14 geeks in SA, so nobody really noticed. I have a feeling it probably affected most of Central Texas.
I finally updated my sig, but now it's lame.
Before you create anything and release it to public, it is important that you have a defense against it.
Anything that you create that you can use as an weapon can be used against you also so you need to defend against it. You or any person are NOT immune to anything.
A good line from the song "Fortress Around Your Heart" from Sting:
"I had to stop in my track for fear of walking on the mines I'd laid".
Don't want to get owned? Run your own dnscache. http://cr.yp.to/djbdns.html
I don't suffer from insanity, I enjoy every minute of it.
Frankenstein's monster & poetic justice imo...
APK
Serves him right.
Andy Tabb
vwguy_65@yahoo.com
I am usually not surprised when I get one incorrect moderation, but two different moderations that are wholly unwarranted demanded that I at least attempt to defend myself against the ignorant. A claim of ignorance is by no means an insult. It specifically means that the moderators lack the proper knowledge and experience to moderate.
First some background:
Now what I was originally responding to was:
This poster was referring to what Mr. Moore might have said if enjoyed online gaming. Hardly offtopic since he is speculating about Mr. Moore's reaction to events that occured regarding his DNS exploit tool in a situation that could be likened to some sort of upset in online gaming.
Now my response to this poster:
In my first line I offered an alternative to the posters hypothetical response for Mr. Moore. It is directly related to my own experience. I clearly indicate that I am not addressing him, and that the use of quotes is a pretty good indication of that. No reasonable person would assume that I intended an angry or emotional response from the poster, or to draw anger from any other posters or readers in this thread.
Now flamebait is directly related to that poster, while trolling is related to the whole thread and the general audience. I cannot imagine that my alternate response could be construed as intentionally baiting anybody into angry passionate responses, nor was the content of my post offtopic. As of yet, I have not received any angry responses over what I written and the original poster wrote back with a Penny Arcade explanation of the phenomenon.
I further went on to ask what it actually meant and gave commentary about the lack of sophistication in some of the "banter" going back and forth in online gaming today.
I ended the post with my opinion of the hacker's exploit and Mr. Moore's response to the whole situation, which was one of amusement.
Now while I wont be so narcissistic to proclaim my post worthy of attention from all or deserving of a +10, the troll and flamebait moderations actually do a disservice. I regularly meta-moderate and more often that not (80%+) I tend to overturn the troll and flamebait moderations. However, this is usually many months after (6+) after the post has occurred.
Maybe a system should be developed in which moderations can be challenged. I am not saying I should be able to do so, but other moderators should be able to do so. Another moderator deciding to give me an insightful, interested, or funny may only be doing so to counteract the effect of the troll/flamebait. This is not in the best interests of the /. community. My post may not actually be de
Comment removed based on user account deletion
Somebody needs their coffee before starting to mod. :-)