Subject: [DNSOP] P2PNames Draft 04: we're adding MORECOWBELL

From: hellekin <[email-masked]>
Date: Sat, 24 Jan 2015 12:15:26 -0300

Dear list members,

today the French newspaper Le Monde published information on a secret
NSA program, MORECOWBELL [0], that reveals the agency has been using the
DNS infrastructure to monitor host and website activity across the Internet.

This monitoring also enable Battle Damage Indication [1], a military
term to say in this case that DNS activity is indicative of physical
damage at a geographic location, and thus can be used to determine
whether a target has been destroyed, in the case the bad guys'
government didn't already shut it down themselves, so that the good guys
can "repeat the attack".

Peer-to-peer name systems using pTLDs effectively protect the Internet
infrastructure by removing authoritarian censorship as well as attack
vectors leading to physical destruction of servers.  To serve resilient
names and protect the safety of fellow sysadmins in exposed datacenters,
to give a different beat to the Internet: please support P2P Names.
Here is draft-04:

https://datatracker.ietf.org/doc/draft-grothoff-iesg-special-use-p2p-names/

As always, you criticism and constructive feedback are very welcome!

If you tweet, please use the #P2PNames hashtag.

Thank you for you attention,

==
hk

[0] MORECOWBELL, the video: https://www.youtube.com/watch?v=1UXHiPWrZxg

If you ever witnessed an actual cow herd, you know that we don't need
"more cow bell", but more cows, as music comes with many bells, not a
bully rhythm from a single one.

[1]
http://www.lemonde.fr/economie/visuel/2015/01/24/cowbells-nouvelles-revelations-sur-les-pratiques-de-la-nsa_4561547_3234.html

---

From: Paul Ferguson <[email-masked]>
Date: Sat, 24 Jan 2015 07:29:27 -0800

On 1/24/2015 7:15 AM, hellekin wrote:

> today the French newspaper Le Monde published information on a
> secret NSA program, MORECOWBELL [0], that reveals the agency has
> been using the DNS infrastructure to monitor host and website
> activity across the Internet.

I have not found & delved into the MCB documents in depth, but from
the cursory description, this sound like nothing more than Passive DNS
monitoring, which is a common practice, especially in the Internet
Security community. pDNS does nothing more than track historical
resolution data between recursive and authoritative DNS servers, and
in fact does *not* track queries made between stub/end-systems and
recursive resolvers, so there is no tracking of *who* made any
specific DNS query.

Here is a pretty good reference for pDNS:

https://archive.farsightsecurity.com/Passive_DNS/

Cheers,

- - ferg

- -- 
Paul Ferguson
VP Threat Intelligence, IID
PGP Public Key ID: 0x54DC85B2
Key fingerprint: 19EC 2945 FEE8 D6C8 58A1 CE53 2896 AC75 54DC 85B2
"I am tormented with an everlasting itch for things remote. I love to
sail forbidden seas." - Herman Melville

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Sat, 24 Jan 2015 16:58:04 +0100

On Sat, Jan 24, 2015 at 07:29:27AM -0800,
 Paul Ferguson <[email-masked]> wrote 
 a message of 47 lines which said:

> monitoring, 

No, MoreCowBell has two parts, passive monitoring *and* active search
by dictionary attacks through open resolvers (to hide the true source)
<http://s1.lemde.fr/mmpub/edt/zip/20150123/194433/assets/images/nsa/3-534x401.jpg>,
last two bullets.

> pDNS does nothing more than track historical resolution data between
> recursive and authoritative DNS servers, and in fact does *not*
> track queries made between stub/end-systems and recursive resolvers,
> so there is no tracking of *who* made any specific DNS query.

Known passive DNS systems like DNSDB ou PassiveDNS.cn do not keep
track of the source IP address (or of the query), for privacy (and
costs) reasons but nothing says that MoreCowBell is so weel-behaved.

---

From: Paul Ferguson <[email-masked]>
Date: Sat, 24 Jan 2015 08:08:11 -0800

On 1/24/2015 7:58 AM, Stephane Bortzmeyer wrote:

> On Sat, Jan 24, 2015 at 07:29:27AM -0800, Paul Ferguson
> <[email-masked]> wrote a message of 47 lines which said:
> 
>> I have not found & delved into the MCB documents in depth, but
>> from the cursory description, this sound like nothing more than
>> Passive DNS monitoring,
> 
> No, MoreCowBell has two parts, passive monitoring *and* active
> search by dictionary attacks through open resolvers (to hide the
> true source) 
last two bullets.

The last two bullets of that slide say:

* (S//REL) Performs DNS lookups and HTTP requests against targets on
regular intervals

* (S//REL) Used to track changes to DNS resolution as well as up/down
status of websites

Again, I have not read any additional documents in detail (please feel
free to provide a pointer [English language, please?]), but the first
bullet indicates nothing more than DNS queries and HTTP requests,
perhaps to track HTTP header status, referrers, user agents (UA), etc.

The second bullet indicates "usual" pDNS behavior ("Used to track
changes to DNS resolution...") and up/down status of websites.

Please provide a pointer to where dictionary attacks are being used,
and for what purposes.

If they are indeed doing that, then I would agree that this activity
must be seen as adversarial in nature, like any other attacker.

>> pDNS does nothing more than track historical resolution data
>> between recursive and authoritative DNS servers, and in fact does
>> *not* track queries made between stub/end-systems and recursive
>> resolvers, so there is no tracking of *who* made any specific DNS
>> query.
> 

I am *very* familiar with pDNS, thanks. :-)

- - ferg

- -- 
Paul Ferguson

---

From: Christian Grothoff <[email-masked]>
Date: Sat, 24 Jan 2015 17:09:03 +0100

MCB is targeting authoritative DNS servers, not recursive resolvers,
and QUANTUMDNS targets caching resolvers.  I suggest you read more
carefully before commenting.

On 01/24/2015 04:29 PM, Paul Ferguson wrote:
> Security community

---

From: Christian Grothoff <[email-masked]>
Date: Sat, 24 Jan 2015 16:58:57 +0100