Subject: first succesful (lab) spoof of a fully source port randomized server reported

From: bert hubert <[email-masked]>
Date: Fri, 8 Aug 2008 13:12:42 +0200

http://tservice.net.ru/~s0mbre/blog//devel/networking/dns/2008_08_08

"Attack took about half of the day, i.e. a bit less than 10 hours.
 So, if you have a GigE lan, any trojaned machine can poison your DNS during
 one night... "

Congratulations are due to Evgeniy Polyakov! He includes the source of his
exploit.

In the meantime, please ponder
http://www.ops.ietf.org/lists/namedroppers/namedroppers.2008/msg01213.html

	Bert
-- 
http://www.PowerDNS.com      Open source, database driven DNS Software 
http://netherlabs.nl              Open and Closed source services

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: [email-masked]
Date: Fri, 08 Aug 2008 13:26:07 +0200 (CEST)

> Congratulations are due to Evgeniy Polyakov! He includes the source of his

Interesting enough. Meanwhile, if I have a recursive name server where
the total traffic from the authoritative servers is in the range of
2 - 3 Mbps, I believe I could safely rate limit the traffic from each
individual IP (representing a possibly spoofed authoritative server) to
100 - 200 kbps. This should raise the bar somewhat.

Steinar Haug, Nethelp consulting, [email-masked]

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 08 Aug 2008 13:47:23 +0200

> 100 - 200 kbps. This should raise the bar somewhat.

/me reconfigures the 1M-node botnets to only send 100 packets/s per bot.

Isn't distributed^Wcloud computing amazing?

Unfortunately, as long as one can try all the combinations in one way or 
another the problem keeps on existing. And if people can send 1G for 12 
hours without nobody noticing, you have worse problems in your network.

Bad part is that one can most likely also crack dnssec or tls in this 
method, it basically is the infinite monkeys typing problem, they will 
produce the answer that you expected. If you work against it, eg "the 
monkeys send me X fake responses lets ratelimit" you might be blocking 
service (denial of service) to something legit again.

Nice and annoying problem, thanks Dan* :)

Greets,
  Jeroen

* = do the dictionaries already contain a proper definition for "to pull 
a Kaminsky on someone"? :)

---

From: "Ondřej Surý" <[email-masked]>
Date: Fri, 8 Aug 2008 14:35:47 +0200

PiAvbWUgcmVjb25maWd1cmVzIHRoZSAxTS1ub2RlIGJvdG5ldHMgdG8gb25seSBzZW5kIDEwMCBwYWNrZXRzL3MgcGVyIGJvdC4KCkhtbSwgYW5kIGhvdyBkbyB5b3Ugc3Bvb2Ygc291cmNlIElQIGFkZHJlc3MgdG9nZXRoZXIgd2l0aCBub3QgYmVpbmcgYmxvY2tlZCBieQpwZXIgc291cmNlIElQIGxpbWl0IGZpbHRlcj8KCk9uZHJlai4KLS0gCiBPbmTFmWVqIFN1csO9CiB0ZWNobmlja8O9IMWZZWRpdGVsL0NoaWVmIFRlY2huaWNhbCBPZmZpY2VyCiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQogQ1ouTklDLCB6LnMucC5vLiAtLSAuY3ogZG9tYWluIHJlZ2lzdHJ5CiBBbWVyaWNrw6EgMjMsMTIwIDAwIFByYWhhIDIsQ3plY2ggUmVwdWJsaWMKIG1haWx0bzpvbmRyZWouc3VyeUBuaWMuY3ogaHR0cDovL25pYy5jei8KIHNpcDpvbmRyZWouc3VyeUBuaWMuY3ogdGVsOis0MjAuMjIyNzQ1MTEwCiBtb2I6KzQyMC43MzkwMTM2OTkgZmF4Ois0MjAuMjIyNzQ1MTEyCiAtLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQo=--to unsubscribe send a message to [email-masked] withthe word 'unsubscribe' in a single line as the message text body.archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Jeroen Massar <[email-masked]>
Date: Fri, 08 Aug 2008 15:05:56 +0200

Ondřej Surý wrote:
> Hmm, and how do you spoof source IP address together with not being blocked by
> per source IP limit filter?

Why bother with spoofing? You have a million *real* hosts available, and 
soon, because of DNS hijacking and then $tricks quite a number more.

We really have to be happy that the updates provided by at least Windows 
Update are reasonably secure ;)

Greets,
  Jeroen

---

From: [email-masked]
Date: Sun, 10 Aug 2008 09:37:18 +0200 (CEST)

> Isn't distributed^Wcloud computing amazing?

The attacker needs to spoof a *specific* source IP. The 1M node botnet
doesn't help here. As Paul Vixie said on bind-users today:

> note that any dns server with a host based firewall can implement a 100%
> effective mitigation for the Polyakov attack, and it's possible that an
> upstream/outboard firewall could also be made to do it.  in freebsd ipfw
> it looks like this:
> 
> add     pipe 1  udp     from any 53 to 204.152.188.20 in
> pipe 1  config  mask src-ip 0xffffffff buckets 32768 bw 56Kbit/s queue 1

which is exactly what I was thinking of.

---

From: Alex Bligh <[email-masked]>
Date: Sun, 10 Aug 2008 09:54:34 +0100

> doesn't help here. As Paul Vixie said on bind-users today:

Let's suppose the attacker /does/ spoof a specific source IP (or a small
group thereof), and uses it to target servers configured like this...

> which is exactly what I was thinking of.

...I think we've just succeeded in converting a poisoning attack into
a DoS vector. Just spoof the IPs of the root nameservers, or NS for
google.com or whatever. I realise DoS of root nameserver access is probably
less dangerous that poisoning then, but...

Alex

---

From: Paul Vixie <[email-masked]>
Date: Sun, 10 Aug 2008 18:30:57 +0000

> ...I think we've just succeeded in converting a poisoning attack into a
> DoS vector. Just spoof the IPs of the root nameservers, or NS for
> google.com or whatever. I realise DoS of root nameserver access is
> probably less dangerous that poisoning then, but...

there are easier ways to DoS a nameserver.  this isn't an exciting new vector.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.