- [DeepSec 2015]50 Shades of WAF
- [DeepSec 2015] File Format Fuzzing in Android – Giving a Stagefright to the Android Installer
- [DeepSec 2015]How to Break XML Encryption – Automatically
- [DeepSec 2015] Hacking Cookies in Modern Web Applications and Browsers
- [DeepSec 2015] Can societies manage the SIGINT monster?
- [LHS Microcast] DeepSec 2015
- [LHS Microcast] Interview w/ Jen Ellis
- Taking out the Eurotrash
- All good things must come to an end
- [DeepSec 2014] Advanced Powershell Threat: Lethal Client Side Attacks using Powershell
- Don't forget to tune in to episode 2 of Might & Mercy #13thage #TTRPG youtu.be/2QUVlHQQ1x0 Would love to hear your feedback. 1 week ago
- That thing we did, yeah episode 1 is out now. Watch "Might & Mercy - S1E1 - When Trouble finds you…" on YouTube… twitter.com/i/web/status/1… 2 weeks ago
- RT @FIRSTdotOrg: It's #FIRSTFriday and there's a new #FIRSTImpressions episode to stream! This interview features #DNSAbuse #SIG co-chair,… 2 weeks ago
- Some music to see you through the dark times… c22 Sessions 2023 Vol.1 mixcloud.com/C22DnB/c22-ses… #DnB #djmixes 3 weeks ago
- #Soon Get ready to watch "Might & Mercy - D&D Campaign - Trailer" on YouTube youtu.be/TqNyc055fyU 2 months ago
- RT @ConSelfOwns: https://t.co/jV4qUr4NdX 3 months ago
The contents of this personal blog are solely my own opinions and comments, as such they do not reflect the opinions of my employer(s) past, present or future. No legal liability is accepted for anything you do, think, or consider fact as the basis of articles and links posted on this blog.
"Three to one...two...one...probability factor of one to one...we have normality, I repeat we have normality. Anything you still can’t cope with is therefore your own problem."
Note: A large portion of content I post on my blog comes from "live blogging" of security conferences. These posts are in notes form and are written live during a talk. As such errors and emissions are expected. I'm only human after all!
Just to be clear, the SOA is an accelerant, that allows cached records to be poisoned. But the actual bug is the lack of birthday protection.
Well there are a number of bugs here. Lack of birthday protection seems to be a common flaw in the architecture of DNS. After all it was never meant to be a secure transaction. DNSSEC to the rescue ??? maybe in 2012 or beyond.
The flaws that make djbdns’s cache vulnerable appear to be the lack of SOA caching, ability to queue multiple (read 200+) identical requests, and the dropping of older queries when the buffer is full and a new request is received. If any one of these flaws was fixed then djbdns would be no more vulnerable than the other offerings (i.e. 1 in 4 billion chance of cache poisoning).
Some fixes would be more effective than others obviously. Refusing to drop old requests when the maximum number was reached could cause various Denial of Service issues (users can no longer request resolution, or the server could be overloaded with thousands of requests). Caching the SOA seems to make sense, but as you said this is only an accelerant. With the other flaws left unpatched the server would never receive a valid response (the older queries would drop off the queue and the response from the nameserver would be ignored). SOA caching coupled with prevention of multiple identical requests seems to make sense from my standpoint (not a DNS expert by any means). Although what process is used to match the new request could be another issue altogether. I’d like to see what overhead Kevin’s unofficial patch for this puts on the server under load.
I’d appreciate your opinions if I’m seeing something wrong here. As I said, I’m no DNS expert ;), I just hack stuff.
There’s lots and lots of partial fixes. The bar I set is that if you don’t protect all names equally, you’re not doing enough. Kevin’s SOA trick works OK but you can just mix his birthday paradox stuff with sibling names from my talk and the attack works essentially just as well.