Slashdot Mirror

← Back to Stories (view on slashdot.org)

DNS Poisoning Hits One of China's Biggest ISPs

Posted by timothy on from the when-bad-childhoods-attack dept.

Support Code writes "ZDNet's Zero Day blog is reporting that a DNS server of one of China's largest ISPs has been poisoned to redirect typos to a malicious site rigged with drive-by exploits. The DNS poisoning attacks are affecting customers of China Netcom (CNC) and are using a malicious iFrame to launch exploits for known vulnerabilities in RealNetworks' RealPlayer, Adobe Flash Player and Microsoft Snapshot Viewer. In this interview with CNet, Dan Kaminsky confirms that attacks are definitely going on in the field."

10 of 86 comments (clear)

  1. As a Chinese Internet user... by gzipped_tar · · Score: 5, Interesting

    ... I feel a bit lucky because I never trust my ISP's name servers. I knew this day would come. If possible, I always use the OpenDNS servers. (Disclaimer here: I'm not saying the OpenDNS service is recommended for security. It's just a matter about reputation.)

    The Chinese ISPs has been known to use manipulated DNS records as a censorship measure, too. See here: http://slashdot.org/article.pl?sid=07/11/18/1824230

    --
    Colorless green Cthulhu waits dreaming furiously.
    1. Re:As a Chinese Internet user... by QuantumG · · Score: 2, Interesting

      So what makes you think OpenDNS were not the first DNS servers attacked?

      That's what I'd do.

      --
      How we know is more important than what we know.
    2. Re:As a Chinese Internet user... by the_denman · · Score: 2, Interesting

      the theory being that OpenDNS is more likely to keep their servers up to date then some of the ISP's name servers

    3. Re:As a Chinese Internet user... by xenobyte · · Score: 5, Interesting

      It's not only China that have ISP's that manipulate DNS records... Here in Denmark for instance most ISP's voluntarily manipulate DNS for a whole list of domains known to host kiddie porn causing a redirect to a warning page. But they also censor the net by 'preventing access' to domains like allofmp3.com and thepiratebay.org which were 'banned' by Fodgedretten, a commerce-oriented court, based on bogus claims of extending danish jurisdiction to foreign-based websites (Russia and Sweden). Unfortunately nobody has yet filed an appeal of these verdicts, so they stand - unvalidated.

      Anyway, this censorship has caused most somewhat technically-oritented people to switch to other nameservers than those provided by their ISPs, usually OpenDNS but also private nameservers they trust. I use our company's which I run (and keep patched!) so I can circumvent the censorship.

      --
      "For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
    4. Re:As a Chinese Internet user... by 3p1ph4ny · · Score: 2, Interesting

      I always hear people on Slashdot bitching about OpenDNS. Apart from running my own resolver, what are my other options?

  2. It's a big flaw by ledow · · Score: 5, Interesting

    It's a big flaw. Someone big was bound to fall foul of it eventually. And to be honest, I can't say that I'm at all surprised. In fact, I'm expecting a lot more.

    I bet that there are still hundreds of large companies that are vulnerable worldwide and I bet that translates to hundreds of thousands, if not millions, of affected people. For instance, last time I checked the whole LGfL (London Grid for Learning) was vulnerable - and they provide DNS / Internet connectivity for every school in London (several million users, hundreds if not thousands of schools) with little alternative because they have been mandated as the recommended solution and thus all "interesting" content is in their private network.

    If they ARE still compromised (and several days after the release of the information, they were still showing up as vulnerable on all those DNS tests and today I got: Your name server, at ***.***.***.***, appears vulnerable to DNS Cache Poisoning. All requests came from the following source port: 32768), that's virtually every school, staff member and student in London (we're probably talking close on a million people because it includes Greater London Boroughs but I'm not sure of the exact figure) which are in trouble because they use the upstream DNS from LGfL as their basis.

    Have we heard anything through official channels? Nope.
    Does everybody just trust LGfL to do their job transparently? Yep.
    Have they done it? Apparently not.
    Have they even heard of it? I don't know, but there have been zero advisories, zero visible configuration changes, that I can see.

    Give it a few months, one of the students will download something and poison the whole of London's educational system and THEN maybe someone will bother to look into it.

    When I heard about this flaw, the first thing I did was check all upstream servers that either my servers or my own home computers use - my cheap ISP (PlusNet) had apparently fixed the issue before I'd even caught wind of the "there may be a DNS problem" posts on Kaminsky's blog. Every other one just seems to be dragging their feet.

  3. unanimous multi-polling? by reiisi · · Score: 4, Interesting

    Check our own ISPs name servers, openDNS's name servers, and we need a third independent name server pool.

    Check all three before moving accepting the IP, and if there is any disagreement, just don't go. Also, send an automated warning to all three DNS pools to re-seed their random number generators and clear the contested IP from their cache.

    Of course, I'm talking about DNS pools as if they already exist. But they should.

    Interactions that need to be secured should also use independent multiple polling before exchanging tokens. Financial institutions, for instance, should keep their own private supernetwork, such that the customer queries their local branch to start login, then queries two other bank-owned check servers, to make sure the branch IP is what the bank says it should be. This would require dedicated browsers, but that's really a given. It's time to quit giving popular browser M, I, or E our credit card numbers to play with. The convenience is not worth it.

    --
    Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
    1. Re:unanimous multi-polling? by totally+bogus+dude · · Score: 3, Interesting

      Anything that's important will be using SSL, so even if someone does hijack your bank's DNS entries your browser will warn you that their certificate isn't signed by someone you trust. The only real worry is from typos or bad links, which is why it's recommended practice to never click links in emails to go to sites that you're going to have to log in to, but rather to use a bookmark or type and check the address yourself.

      As for the "check against lots of different servers" idea, there's three main problems.

      1. If the "pools" are very independent of each other (i.e. different management) then it just makes DoS attacks against certain sites very easy (get in the pool, behave for a while, then start serving nonsense results for www.example.com - voila, anyone using your server to verify addresses will reject that domain).

      2. If the pools are under the same management, then they're very likely to be running the same software version on the same platform under the same firewall protection, etc. So an attacker may need to compromise some more servers, but they're all identical.

      3. For your financial institutions example, how does the browser know which "check servers" to use? You can't rely on a single reply from one of their authoritative servers, since you don't trust them. If you ask a bunch of other servers, then you're trusting all of them not to be trying to DoS the site in question (and also not to be poisoned themselves).

      I guess you could be intending that each bank supplies a browser for use with its website, but then you take a lot of the convenience out of using online banking; in particular, cross-platform support would be a problem.

    2. Re:unanimous multi-polling? by OriginalArlen · · Score: 2, Interesting

      The only real fix available now for the fundamental vulnerability is DNSSEC. There's an excellent doc up on ISC's site called DNSSEC in Six Minutes for those who read bothered to read Kaminsky's actual presentation (especially the last 40 or so slides on subtle ways security systems like SSL break when you can't trust DNS), put that together with the ten hour exploit for patched servers, and realised we're not out of the woods yet by a long chalk...

      --

      Everything I needed to know about life, I learnt from Blake's Seven
  4. Just a warm-up by Ant+P. · · Score: 3, Interesting

    If they were trying to do damage to china, wouldn't they have simply redirected everyone to anti-government propaganda sites instead?