Re: djbdns/dnscache poisoning weakness

On Feb 12, 2009, at 3:34 PM, Michael Sierchio wrote:

> Paul Jarc wrote:
>
>
>> ...  An attacker can send an SOA
>> query ...
>
> Really?  I think it's important to be explicit about what
> the threat model is.  Attackers don't make queries to your
> dnscache, presumably.  They can induce you to make such
> a query, and hope to forge a response, but with no more
> chance of success for any other poisoning attack against
> dnscache.
>

It's quite possible for an attacker to directly make queries to a  
resolver, on a good number of networks.


Many networks don't stop spoofed packets belonging to their network  
from entering their borders. Sometimes due to lack of clue, sometimes  
because their network architecture doesn't allow them to. The attacker  
figures out an unused IP in your network that your resolver will  
listen to, and spoofs the queries.

Networks with large numbers of residential users make it trivial to  
find one that's exploitable and launch the attack from there.

ISPs that sell to multihomed customers need to allow their customers  
to use their resolver, but can't always predict where those packets  
are coming from, which means those addresses are spoofable. I.e. I  
have a /16, and my resolver lets anyone in that /16 access it. You're  
my customer, and I assign you a /24 out of my /16. You're multihomed  
with me and another ISP. Even though I assigned you that /24, I can't  
blackhole traffic for that /24 coming into my borders, since you may  
be preferring the other ISP for one reason or another. That makes  
your /24 spoofable to my resolver.

And lastly, the attacker can be one of your customers/employees/ 
whatever.


I'm not saying every resolver out there accepts queries from anyone,  
but on networks above a certain size it's not hard to find one way in.

Some of the above are fixable, some aren't. My only goal is that if  
someone DOES find a way in, they're still faced with 2^32 complexity  
in poisoning. I'll notice a 10mbps flood lasting a few days. I  
probably can't react fast enough to deal with one that only requires  
tens of minutes.

-- Kevin