Slashdot Mirror
DNS Poisoning Hits One of China's Biggest ISPs
Support Code writes "ZDNet's Zero Day blog is reporting that a DNS server of one of China's largest ISPs has been poisoned to redirect typos to a malicious site rigged with drive-by exploits. The DNS poisoning attacks are affecting customers of China Netcom (CNC) and are using a malicious iFrame to launch exploits for known vulnerabilities in RealNetworks' RealPlayer, Adobe Flash Player and Microsoft Snapshot Viewer. In this interview with CNet, Dan Kaminsky confirms that attacks are definitely going on in the field."
is property of html, not Apple Inc.
Since when do I have to input my SSN to post to slashdot?
Modding me -1 troll doesn't make me wrong.
... I feel a bit lucky because I never trust my ISP's name servers. I knew this day would come. If possible, I always use the OpenDNS servers. (Disclaimer here: I'm not saying the OpenDNS service is recommended for security. It's just a matter about reputation.)
The Chinese ISPs has been known to use manipulated DNS records as a censorship measure, too. See here: http://slashdot.org/article.pl?sid=07/11/18/1824230
Colorless green Cthulhu waits dreaming furiously.
lol
Can we check the IP origin of that last post please?
*ring*ring*
Badguy1: "Hello"
Badguy2: "Hi its me, you ready to do this thing tonight?"
Badguy1: "sure, dont forget to bring the stuff"
*click*
Badguy2: "hey did you just hear a click on the line?"
Badguy1: "yeah! - do you think we are being tapped by the NSA?"
Anonymous Coward: "No its not our style"
Badguy1: "OK"
Badguy2: "OK"
It's a big flaw. Someone big was bound to fall foul of it eventually. And to be honest, I can't say that I'm at all surprised. In fact, I'm expecting a lot more.
I bet that there are still hundreds of large companies that are vulnerable worldwide and I bet that translates to hundreds of thousands, if not millions, of affected people. For instance, last time I checked the whole LGfL (London Grid for Learning) was vulnerable - and they provide DNS / Internet connectivity for every school in London (several million users, hundreds if not thousands of schools) with little alternative because they have been mandated as the recommended solution and thus all "interesting" content is in their private network.
If they ARE still compromised (and several days after the release of the information, they were still showing up as vulnerable on all those DNS tests and today I got: Your name server, at ***.***.***.***, appears vulnerable to DNS Cache Poisoning. All requests came from the following source port: 32768), that's virtually every school, staff member and student in London (we're probably talking close on a million people because it includes Greater London Boroughs but I'm not sure of the exact figure) which are in trouble because they use the upstream DNS from LGfL as their basis.
Have we heard anything through official channels? Nope.
Does everybody just trust LGfL to do their job transparently? Yep.
Have they done it? Apparently not.
Have they even heard of it? I don't know, but there have been zero advisories, zero visible configuration changes, that I can see.
Give it a few months, one of the students will download something and poison the whole of London's educational system and THEN maybe someone will bother to look into it.
When I heard about this flaw, the first thing I did was check all upstream servers that either my servers or my own home computers use - my cheap ISP (PlusNet) had apparently fixed the issue before I'd even caught wind of the "there may be a DNS problem" posts on Kaminsky's blog. Every other one just seems to be dragging their feet.
In fact Frosty Post AC has a point.
Chinese speakers (at least in Beijing) often use the word é£ä (neige) as a filler word; much in the same way as 'uh' or 'er' are used in the English language.
For anyone with no understanding of the Chinese language will often be confronted by the words 'nigga, nigga' when walking on the streets of Beijing.
It may be a good idea to check your DNS server to see if it is vulnerable. Dan Kaminsky has a tool that shows vulnerability on his blog.
Check our own ISPs name servers, openDNS's name servers, and we need a third independent name server pool.
Check all three before moving accepting the IP, and if there is any disagreement, just don't go. Also, send an automated warning to all three DNS pools to re-seed their random number generators and clear the contested IP from their cache.
Of course, I'm talking about DNS pools as if they already exist. But they should.
Interactions that need to be secured should also use independent multiple polling before exchanging tokens. Financial institutions, for instance, should keep their own private supernetwork, such that the customer queries their local branch to start login, then queries two other bank-owned check servers, to make sure the branch IP is what the bank says it should be. This would require dedicated browsers, but that's really a given. It's time to quit giving popular browser M, I, or E our credit card numbers to play with. The convenience is not worth it.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
I know you're just trying to be funny, but allow me still to (hopefully) educate some of your readers.
If anyone was wiretapping and using reasonably well-designed equipment, you wouldn't hear clicks, since clicks can be avoided. I think "high-impedance circuitry" was the phrase used to justify that claim.
Also, if the wiretappers are playing by the rules, you can just press C on your phone (or play back two tones with the corresponding frequencies but less amplitude than your phone does) to shut down the recording equipment at the other end.
Source: Matt Blaze, http://www.usenix.org/events/lisa05/tech/mp3/blaze.mp3, http://www.usenix.org/events/lisa05/tech/.
Interesting to know, if you plan on being wiretapped. What's also interesting to know is that wiretapping equipment is (usually) illegal to posses, yet can be bought from law enforcement agencies on ebay :)