Re: djbdns/dnscache poisoning weakness

Kevin Day <[email protected]> wrote:
> Step 4: Now dnscache has 200 queries open. All 200 queries have items
> #1, #2 and #3 the same. The only difference is #4 and #5. The attacker
> sends a flood of spoofed packets, with varying #4 and #5. The
> difference here is that dnscache has 200 possible queries to match
> each one of those up with. The attacker sends one spoofed packet, and
> now has 200 times the odds of finding a matching query on dnscache's
> side.

I know you said you were intentionally simplifying, but I felt like
going into more detail here, partly to make sure I've got it right
myself.

Assume the attacker succeeds with one of the forged responses.  An
unpatched dnscache will use the forged answer to reply to the
corresponding query from the attacker.  But the other 199 outgoing
queries will continue to wait for their own responses.  Each one will
eventually receive a matching response (either geniuine or forged).
Whatever response is received last for the outgoing queries is the one
that will stay in the cache and be used to reply to future clients.

So getting a forged response in for one of the first 199 queries
doesn't help to poison the record asked about, since that cache entry
will quickly be overwritten by a subsequent response for a duplicate
query.  Instead, the attacker must ask about a name they're not trying
to poison, and include in the forged responses an unrelated extra
record about the name they are trying to poison.  Genuine responses
won't include records about that unrelated name, so that forged record
will remain in the cache until its TTL expires.

Since every response includes NS/glue records, poisoning those records
has to be done with queries to the parent server.  If an attacker asks
dnscache about made-up-name.example.com 200 times and includes forged
NS/glue in their forged responses, those will be replaced by the real
NS/glue in subsequent genuine responses.  Instead, the attacker has to
ask about made-up-name.com, and forge responses from the .com servers,
including unrelated NS/glue records for example.com.


paul