Recent Posts
- [DeepSec 2015]50 Shades of WAF
- [DeepSec 2015] File Format Fuzzing in Android – Giving a Stagefright to the Android Installer
- [DeepSec 2015]How to Break XML Encryption – Automatically
- [DeepSec 2015] Hacking Cookies in Modern Web Applications and Browsers
- [DeepSec 2015] Can societies manage the SIGINT monster?
- [LHS Microcast] DeepSec 2015
- [LHS Microcast] Interview w/ Jen Ellis
- Taking out the Eurotrash
- All good things must come to an end
- [DeepSec 2014] Advanced Powershell Threat: Lethal Client Side Attacks using Powershell
Archives
@ChrisJohnRiley
- Sometimes this is how I feel when I try to explain what I do 🤷♂️ https://t.co/rDh1D56uJ6 21 hours ago
- RT @_workchronicles: Imposter Syndrome https://t.co/VhqrVfDMrk 1 day ago
- Oh no, who could have forseen the effects of Brexit, tighter immigration controls, growing nationalism, and a clima… twitter.com/i/web/status/1… 1 day ago
- I’ve been using @lendwithcare for a few years to help people in low income countries work their way out of poverty.… twitter.com/i/web/status/1… 1 day ago
- RT @DirkGently_Bot: "It is a well-known fact that those people to want to rule people are, ipso facto, those least suited to do it" - #Doug… 1 day ago
- My brain 🧠: Waking up at 6am and starting to read emails makes for a poor start to the day… Also my brain 🧠: Next… twitter.com/i/web/status/1… 2 days ago
Links
Disclaimer
The contents of this personal blog are solely my own opinions and comments, as such they do not reflect the opinions of my employer(s) past, present or future. No legal liability is accepted for anything you do, think, or consider fact as the basis of articles and links posted on this blog.
"Three to one...two...one...probability factor of one to one...we have normality, I repeat we have normality. Anything you still can’t cope with is therefore your own problem."
Note: A large portion of content I post on my blog comes from "live blogging" of security conferences. These posts are in notes form and are written live during a talk. As such errors and emissions are expected. I'm only human after all!
Just to be clear, the SOA is an accelerant, that allows cached records to be poisoned. But the actual bug is the lack of birthday protection.
Well there are a number of bugs here. Lack of birthday protection seems to be a common flaw in the architecture of DNS. After all it was never meant to be a secure transaction. DNSSEC to the rescue ??? maybe in 2012 or beyond.
The flaws that make djbdns’s cache vulnerable appear to be the lack of SOA caching, ability to queue multiple (read 200+) identical requests, and the dropping of older queries when the buffer is full and a new request is received. If any one of these flaws was fixed then djbdns would be no more vulnerable than the other offerings (i.e. 1 in 4 billion chance of cache poisoning).
Some fixes would be more effective than others obviously. Refusing to drop old requests when the maximum number was reached could cause various Denial of Service issues (users can no longer request resolution, or the server could be overloaded with thousands of requests). Caching the SOA seems to make sense, but as you said this is only an accelerant. With the other flaws left unpatched the server would never receive a valid response (the older queries would drop off the queue and the response from the nameserver would be ignored). SOA caching coupled with prevention of multiple identical requests seems to make sense from my standpoint (not a DNS expert by any means). Although what process is used to match the new request could be another issue altogether. I’d like to see what overhead Kevin’s unofficial patch for this puts on the server under load.
I’d appreciate your opinions if I’m seeing something wrong here. As I said, I’m no DNS expert ;), I just hack stuff.
There’s lots and lots of partial fixes. The bar I set is that if you don’t protect all names equally, you’re not doing enough. Kevin’s SOA trick works OK but you can just mix his birthday paradox stuff with sibling names from my talk and the attack works essentially just as well.