Subject: [DNSOP] DNS privacy and Team Cymru's report on 300, 000 SOHO routers with compromised DNS settings

From: Dan York <[email-masked]>
Date: Thu, 6 Mar 2014 23:09:33 +0000

DNSOP members,

Given our session today talking about protecting DNS privacy, I found an interesting bit of synchronicity upon going back to my room and seeing this article in my feeds about a compromise of at least 300,000 small office / home office (SOHO) home routers  by a variety of attacks in which their DNS server values were changed and consumers were redirected to other pages as a result:

http://www.circleid.com/posts/widespread_compromised_routers_discovered_with_altered_dns_configurations/
(and http://www.circleid.com/posts/20140305_dynamic_dns_customers_check_your_router_settings/ )

The actual report from Team Cymru was announced just this past Monday - https://twitter.com/teamcymru/status/440488571666198528  and is available at:

https://www.team-cymru.com/ReadingRoom/Whitepapers/2013/TeamCymruSOHOPharming.pdf

Now, in this case the attackers compromised the local network devices and took over control of the local recursive resolvers.  In this case of the attacker controlling the recursive resolver, I don't know that any of the various solutions thrown around today would do anything to help with this.  I don't even see DNSSEC helping much here, either, given that the attacker could just strip out the DNSSEC info (unless, perhaps, the home computers were running full (vs stub) recursive resolvers that also did DNSSEC-validation).

I just thought it was an interesting example of a type of attack against DNS that is out there now.

Dan

--
Dan York
Senior Content Strategist, Internet Society
[email-masked] <mailto:[email-masked]>   +1-802-735-1624
Jabber: [email-masked] <mailto:[email-masked]>
Skype: danyork   http://twitter.com/danyork

http://www.internetsociety.org/deploy360/

---

From: "Hosnieh Rafiee" <[email-masked]>
Date: Fri, 7 Mar 2014 00:34:52 +0100

Dan,

I guess you have to separate the problem of compromising device with the
case where we are looking for only confidentiality or privacy. IMHO, this is
somewhat out of scope. 

However, we cannot ignore it. In this special case, just the admin of that
recursive resolver needs to react to that attack and without that nobody can
understand what's going on there but the important thing is how to
re-establish the trust with all the other recursive resolvers that already
used that node.  I think this is important because it might not be clear how
many nodes already used this resolver but for the first case you can do
nothing except waiting for immediate action of rescue team.

Hosnieh

 

From: DNSOP [mailto:[email-masked]] On Behalf Of Dan York
Sent: Friday, March 07, 2014 12:10 AM
To: [email-masked]
Subject: [DNSOP] DNS privacy and Team Cymru's report on 300, 000 SOHO
routers with compromised DNS settings

DNSOP members,

Given our session today talking about protecting DNS privacy, I found an
interesting bit of synchronicity upon going back to my room and seeing this
article in my feeds about a compromise of at least 300,000 small office /
home office (SOHO) home routers  by a variety of attacks in which their DNS
server values were changed and consumers were redirected to other pages as a
result:

http://www.circleid.com/posts/widespread_compromised_routers_discovered_with
_altered_dns_configurations/

(and
http://www.circleid.com/posts/20140305_dynamic_dns_customers_check_your_rout
er_settings/ )

The actual report from Team Cymru was announced just this past Monday -
https://twitter.com/teamcymru/status/440488571666198528  and is available
at:

https://www.team-cymru.com/ReadingRoom/Whitepapers/2013/TeamCymruSOHOPharmin
g.pdf 

Now, in this case the attackers compromised the local network devices and
took over control of the local recursive resolvers.  In this case of the
attacker controlling the recursive resolver, I don't know that any of the
various solutions thrown around today would do anything to help with this.
I don't even see DNSSEC helping much here, either, given that the attacker
could just strip out the DNSSEC info (unless, perhaps, the home computers
were running full (vs stub) recursive resolvers that also did
DNSSEC-validation).

I just thought it was an interesting example of a type of attack against DNS
that is out there now.

Dan

--

Dan York

---

From: Andrew Sullivan <[email-masked]>
Date: Thu, 6 Mar 2014 18:42:22 -0500

On Thu, Mar 06, 2014 at 11:09:33PM +0000, Dan York wrote:

> this case of the attacker controlling the recursive resolver, I
> don't know that any of the various solutions thrown around today
> would do anything to help with this.  

But this was exactly the question I (among others) was trying to ask
at the mic.  From whom exactly are we trying to protect ourselves?  If
one of the answers is, "our immediate upstream resolver", there's
actually a possible answer to that: either don't have one, or prove
that the one you're talking to is one you can trust.

But to start that discussion, we first have to figure out from whom we
are protecting ourselves.

Best regards,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Paul Wouters <[email-masked]>
Date: Fri, 7 Mar 2014 04:00:34 -0500 (EST)

On Thu, 6 Mar 2014, Dan York wrote:

> Now, in this case the attackers compromised the local network devices and took over control of the local recursive resolvers.  In this
> case of the attacker controlling the recursive resolver, I don't know that any of the various solutions thrown around today would do
> anything to help with this.

Run a local resolver and reconfigure it automatically (eg using
dnssec-trigger and friends) to use the DHCP obtained DNS servers
only as forwarders.

>  I don't even see DNSSEC helping much here, either, given that the attacker could just strip out the DNSSEC
> info (unless, perhaps, the home computers were running full (vs stub) recursive resolvers that also did DNSSEC-validation).

If the domains were signed, even if you used the rogue DNS as forwarder,
you would at least notice you are under attack.

Paul

---

From: Tony Finch <[email-masked]>
Date: Fri, 7 Mar 2014 09:20:51 +0000

Paul Wouters <[email-masked]> wrote:
> > I don't even see DNSSEC helping much here, either, given that the
> > attacker could just strip out the DNSSEC info (unless, perhaps, the
> > home computers were running full (vs stub) recursive resolvers that
> > also did DNSSEC-validation).
>

As I understand it from the CERT Polska report, the aim of the malware is
to send people to a phishing site instead of to legit banking sites etc.

http://www.cert.pl/news/8019/langswitch_lang/en
(if you get a redirect try reloading the link)

If properly deployed, with validation on the users' end hosts, DNSSEC
would absolutely have prevented this attack from successfully stealing
banking credentials.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
Northwest FitzRoy, Sole: Northerly, backing southerly later, 4 or 5,
increasing 6 or 7, perhaps gale 8 later. Rough or very rough. Rain or drizzle.
Moderate occasionally poor.