Slashdot Mirror
DNS Attack Writer a Victim of His Own Creation
BobB writes "HD Moore has been owned. Moore, the creator of the popular Metasploit hacking toolkit, has become the victim of a computer attack. It happened on Tuesday morning, when Moore's company, BreakingPoint, had some of its Internet traffic redirected to a fake Google page that was being run by a scammer. According to Moore, the hacker was able to do this by launching what's known as a cache poisoning attack on a DNS server on AT&T's network that was serving the Austin, Texas, area. One of BreakingPoint's servers was forwarding DNS (Domain Name System) traffic to the AT&T server, so when it was compromised, so was HD Moore's company."
I wonder if, when he got attacked, he just leaned back in his big leather chair, and chuckled, "Well played, sir, well played."
Proof that Karma is real baby!
Eviscerate the Proletariat!
Karma takes a break occasionally, but seems to have been alert when it saw this opportunity!!!
Bravo!!!!!!!
I predict another one of those raps about how lame this guy was and how "it can't possibly happen to us"...
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
The reporter has published a correction, which is also reflected on the Metasploit Blog.
Huh???
Your it.
Well, all I can say is, no one, not even him can prevent this shit from happening if a server out of their control such as this is unpatched. He should give at&t hell. All the other big ones like comcast and verizon claim to be fully patched. I understand the size of at&t's network but this is no excuse when everyone uses your network and pays good money for it.
Serves him right.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
but with less pissed off villagers and torches.
Not to burst your bubble but that's an ancient proverb. I'm sure it's pretty common... the Jews had it way back in Solomon's day. Check Proverbs 26:27a.
Alexander Peter Kristopeit bought his basement from his mommy for one dollar.
what goes around, comes around.
Since the attack wasn't on BreakingPoint, but rather than upstream DNS server, he pretty much just got swept up in the dragnet. These kind of attacks seem scarier than a direct attack, since you can do "everything right" with regard to patching, updating, firewalling, etc, and still get owned.
"Can't you see that everyone is buying station wagons?"
Yeah, that's what I said. He didn't pwn himself, he was pwned by someone using a tool he himself wrote. Two different things.
My blog
http://www.pcworld.com/businesscenter/article/149136/dns_attack_writer_a_victim_of_his_own_creation.html
Plenty of old English sayings for this one.
"Live by the sword, die by the sword."
"What goes around, comes around."
"You reap what you sow."
Etc.
$nice = $webHosting + $domainNames + $sslCerts
This is real irony. So, if someone tags this story "irony", he would be correct.
Knowledge is power. Knowledge shared is power lost.
For tis the sport to have the engineer hoist with his own petard.
Really this proverb is best portrayed by the timeless coyote chasing the road runner cartoons.
It's interesting to see how widespread this exploit has become. I've checked my home and office connections using Dan Kaminsky's handy DNS Checker and it appears that my ISPs have taken measures to avoid this problem.
Unfortunately, I also travel a good deal for work, and it's hard to be sure that the ISP used by whatever-hotel-I'm-staying-at-this-week will be as proactive.
The guys in TFA got pwned by being redirected to a bogus Google look-alike page. As I understand it, this kind of attack would be noticeable when attempting to use a secure (HTTPS) web connection, because the browser should throw up a certificate error. Is this true? What other ways might be used to detect this problem?
Yeah.. it'd be more like the US getting attacked by weapons they made and sold to Iraq or something... oh hang on..
Before this DNS thingie, I'd have said no. But I guess I'll be keeping my fingers crossed from now on.
In Soviet Russia your hacking toolkit owns you.
America, Home of the Brave.
Especially if you yourself made it.
No mod points, no meta-moderating/Firehose/all the other free work Slashdot wants me to do.
Well, if all the posts are filled with mindless, off-topic dribble about how, in Soviet Russia, we welcome the opportunity exploit Natalie Portman's hot grit-pouring overlords with our vulnerable DNS servers, then it's a safe bet your on slashdot.
Saying #1: Jesus to Peter after Peter had sliced the ear off of the slave Malchus.
Saying #2: ????
Saying #3: Galatians 6:7... though I was really tempted to say PROFIT!!!
"Wie een kuil graaft voor een ander, valt er zelf in"
Literally translated: Who a hole dug for an other*, falled** their self in. (* You knew that "another" used to be "an other"? And that "an apron" used to be "a napron"? It's happening again with "a lot" - soon that'll be "alot". ** Artistic license applied for).
Voor = for. een = an/one. zelf = self. in = in.
Get your own free personal location tracker
This DNS test is much better. https://www.dns-oarc.net/oarc/services/dnsentropy
The problem is that bad DNS responses should not be a source of vulnerability. Anytime there is traffic outside of your trusted domain, the identity of the remote system should not be trusted without a secure connection. There is work on Secure DNS, but I think it is better just to consider DNS unreliable, especially since wireless access points are common, and can give you whatever DNS they want. Even if you use another DNS server, it is easy enough to override it at the router. Unencrypted traffic should always be considered untrusted and prone to hacking. We need a system of secondary (tertiary, etc?) certificate signing so that every web site doesn't have to pay for a commercially signed certificate. That is more efficient and reliable than Secure DNS. (Right?)
http://www.youtube.com/watch?v=_hnylJ2scVU
Just to be sure, make sure none of the posters know the difference between you're and your or loose and lose. I was momentarily confused when someone correctly used lose earlier in the thread though so I am still suspicious.
The trouble with the rat race is that even if you win, you're still a rat." Lily Tomlin
Actually, it's supported by a much larger, poorer city than you'd guess from looking at the Strip. The casino hotels are largely run by people who could never afford to stay in them.
Talk to one of the illegal Mexicans who have to loiter street-level handing out callgirl cards. They can tell you about the real LV experience.
DRM: Terminator crops for your mind!
This is correct. Thee is an object, and thou is only a subject.
Comment removed based on user account deletion
Comment removed based on user account deletion
"Wie een kuil graaft voor een ander is een arbeider" :)
youtube link.
I have no idea what AT&T's network is like, but this affected us in San Antonio as well. But there are approximatly 14 geeks in SA, so nobody really noticed. I have a feeling it probably affected most of Central Texas.
I finally updated my sig, but now it's lame.
Before you create anything and release it to public, it is important that you have a defense against it.
Anything that you create that you can use as an weapon can be used against you also so you need to defend against it. You or any person are NOT immune to anything.
A good line from the song "Fortress Around Your Heart" from Sting:
"I had to stop in my track for fear of walking on the mines I'd laid".
All good - but I can't follow the "hole" -> "cowl" jump. Does cowl mean what you think it means?
:)
Maar Nederlands is een goeie taal. Even if I'm not very good at it.
Get your own free personal location tracker
Don't want to get owned? Run your own dnscache. http://cr.yp.to/djbdns.html
I don't suffer from insanity, I enjoy every minute of it.
I am usually not surprised when I get one incorrect moderation, but two different moderations that are wholly unwarranted demanded that I at least attempt to defend myself against the ignorant. A claim of ignorance is by no means an insult. It specifically means that the moderators lack the proper knowledge and experience to moderate.
First some background:
Now what I was originally responding to was:
This poster was referring to what Mr. Moore might have said if enjoyed online gaming. Hardly offtopic since he is speculating about Mr. Moore's reaction to events that occured regarding his DNS exploit tool in a situation that could be likened to some sort of upset in online gaming.
Now my response to this poster:
In my first line I offered an alternative to the posters hypothetical response for Mr. Moore. It is directly related to my own experience. I clearly indicate that I am not addressing him, and that the use of quotes is a pretty good indication of that. No reasonable person would assume that I intended an angry or emotional response from the poster, or to draw anger from any other posters or readers in this thread.
Now flamebait is directly related to that poster, while trolling is related to the whole thread and the general audience. I cannot imagine that my alternate response could be construed as intentionally baiting anybody into angry passionate responses, nor was the content of my post offtopic. As of yet, I have not received any angry responses over what I written and the original poster wrote back with a Penny Arcade explanation of the phenomenon.
I further went on to ask what it actually meant and gave commentary about the lack of sophistication in some of the "banter" going back and forth in online gaming today.
I ended the post with my opinion of the hacker's exploit and Mr. Moore's response to the whole situation, which was one of amusement.
Now while I wont be so narcissistic to proclaim my post worthy of attention from all or deserving of a +10, the troll and flamebait moderations actually do a disservice. I regularly meta-moderate and more often that not (80%+) I tend to overturn the troll and flamebait moderations. However, this is usually many months after (6+) after the post has occurred.
Maybe a system should be developed in which moderations can be challenged. I am not saying I should be able to do so, but other moderators should be able to do so. Another moderator deciding to give me an insightful, interested, or funny may only be doing so to counteract the effect of the troll/flamebait. This is not in the best interests of the /. community. My post may not actually be de
HDM doesn't need publicity. Anyone who cares about this (i.e. the geek/security community) already knows who the hell he is. It'd be about as useful as Fyodor putting up an advisory to say his hosts had been port scanned by Nmap.
Me failed English...
FreeBSD over Linux. If my comments seem odd, this may explain...
Comment removed based on user account deletion
Oops. My mistake. I /ment/ to say "its a safe bet your on slashdot." rather /then/ "it's a safe bet your on slashdot.".
Thank goodness for the Grammar Nazi's. If they hadn't shown up, I might have suspected I was wrong.
Somebody needs their coffee before starting to mod. :-)