Slashdot Mirror
DNS Attack Writer a Victim of His Own Creation
BobB writes "HD Moore has been owned. Moore, the creator of the popular Metasploit hacking toolkit, has become the victim of a computer attack. It happened on Tuesday morning, when Moore's company, BreakingPoint, had some of its Internet traffic redirected to a fake Google page that was being run by a scammer. According to Moore, the hacker was able to do this by launching what's known as a cache poisoning attack on a DNS server on AT&T's network that was serving the Austin, Texas, area. One of BreakingPoint's servers was forwarding DNS (Domain Name System) traffic to the AT&T server, so when it was compromised, so was HD Moore's company."
I wonder if, when he got attacked, he just leaned back in his big leather chair, and chuckled, "Well played, sir, well played."
Proof that Karma is real baby!
Eviscerate the Proletariat!
The reporter has published a correction, which is also reflected on the Metasploit Blog.
Well, all I can say is, no one, not even him can prevent this shit from happening if a server out of their control such as this is unpatched. He should give at&t hell. All the other big ones like comcast and verizon claim to be fully patched. I understand the size of at&t's network but this is no excuse when everyone uses your network and pays good money for it.
Serves him right.
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.
what goes around, comes around.
Since the attack wasn't on BreakingPoint, but rather than upstream DNS server, he pretty much just got swept up in the dragnet. These kind of attacks seem scarier than a direct attack, since you can do "everything right" with regard to patching, updating, firewalling, etc, and still get owned.
"Can't you see that everyone is buying station wagons?"
Yeah, that's what I said. He didn't pwn himself, he was pwned by someone using a tool he himself wrote. Two different things.
My blog
http://www.pcworld.com/businesscenter/article/149136/dns_attack_writer_a_victim_of_his_own_creation.html
This is real irony. So, if someone tags this story "irony", he would be correct.
Knowledge is power. Knowledge shared is power lost.
For tis the sport to have the engineer hoist with his own petard.
Really this proverb is best portrayed by the timeless coyote chasing the road runner cartoons.
It's interesting to see how widespread this exploit has become. I've checked my home and office connections using Dan Kaminsky's handy DNS Checker and it appears that my ISPs have taken measures to avoid this problem.
Unfortunately, I also travel a good deal for work, and it's hard to be sure that the ISP used by whatever-hotel-I'm-staying-at-this-week will be as proactive.
The guys in TFA got pwned by being redirected to a bogus Google look-alike page. As I understand it, this kind of attack would be noticeable when attempting to use a secure (HTTPS) web connection, because the browser should throw up a certificate error. Is this true? What other ways might be used to detect this problem?
Yeah.. it'd be more like the US getting attacked by weapons they made and sold to Iraq or something... oh hang on..
In Soviet Russia your hacking toolkit owns you.
America, Home of the Brave.
Well, if all the posts are filled with mindless, off-topic dribble about how, in Soviet Russia, we welcome the opportunity exploit Natalie Portman's hot grit-pouring overlords with our vulnerable DNS servers, then it's a safe bet your on slashdot.
Saying #1: Jesus to Peter after Peter had sliced the ear off of the slave Malchus.
Saying #2: ????
Saying #3: Galatians 6:7... though I was really tempted to say PROFIT!!!
This DNS test is much better. https://www.dns-oarc.net/oarc/services/dnsentropy
The problem is that bad DNS responses should not be a source of vulnerability. Anytime there is traffic outside of your trusted domain, the identity of the remote system should not be trusted without a secure connection. There is work on Secure DNS, but I think it is better just to consider DNS unreliable, especially since wireless access points are common, and can give you whatever DNS they want. Even if you use another DNS server, it is easy enough to override it at the router. Unencrypted traffic should always be considered untrusted and prone to hacking. We need a system of secondary (tertiary, etc?) certificate signing so that every web site doesn't have to pay for a commercially signed certificate. That is more efficient and reliable than Secure DNS. (Right?)
Comment removed based on user account deletion
Before you create anything and release it to public, it is important that you have a defense against it.
Anything that you create that you can use as an weapon can be used against you also so you need to defend against it. You or any person are NOT immune to anything.
A good line from the song "Fortress Around Your Heart" from Sting:
"I had to stop in my track for fear of walking on the mines I'd laid".
Don't want to get owned? Run your own dnscache. http://cr.yp.to/djbdns.html
I don't suffer from insanity, I enjoy every minute of it.
I am usually not surprised when I get one incorrect moderation, but two different moderations that are wholly unwarranted demanded that I at least attempt to defend myself against the ignorant. A claim of ignorance is by no means an insult. It specifically means that the moderators lack the proper knowledge and experience to moderate.
First some background:
Now what I was originally responding to was:
This poster was referring to what Mr. Moore might have said if enjoyed online gaming. Hardly offtopic since he is speculating about Mr. Moore's reaction to events that occured regarding his DNS exploit tool in a situation that could be likened to some sort of upset in online gaming.
Now my response to this poster:
In my first line I offered an alternative to the posters hypothetical response for Mr. Moore. It is directly related to my own experience. I clearly indicate that I am not addressing him, and that the use of quotes is a pretty good indication of that. No reasonable person would assume that I intended an angry or emotional response from the poster, or to draw anger from any other posters or readers in this thread.
Now flamebait is directly related to that poster, while trolling is related to the whole thread and the general audience. I cannot imagine that my alternate response could be construed as intentionally baiting anybody into angry passionate responses, nor was the content of my post offtopic. As of yet, I have not received any angry responses over what I written and the original poster wrote back with a Penny Arcade explanation of the phenomenon.
I further went on to ask what it actually meant and gave commentary about the lack of sophistication in some of the "banter" going back and forth in online gaming today.
I ended the post with my opinion of the hacker's exploit and Mr. Moore's response to the whole situation, which was one of amusement.
Now while I wont be so narcissistic to proclaim my post worthy of attention from all or deserving of a +10, the troll and flamebait moderations actually do a disservice. I regularly meta-moderate and more often that not (80%+) I tend to overturn the troll and flamebait moderations. However, this is usually many months after (6+) after the post has occurred.
Maybe a system should be developed in which moderations can be challenged. I am not saying I should be able to do so, but other moderators should be able to do so. Another moderator deciding to give me an insightful, interested, or funny may only be doing so to counteract the effect of the troll/flamebait. This is not in the best interests of the /. community. My post may not actually be de