DNS Exploit in the Wild

[Modelworks]

Originally posted by: spidey07
Just to add from what our DNS guys were talking about today (yes, 6 people devoted to nothing but DNS).

Yesterday MS security "experts" told them they had a patch in the works for MS DNS servers, but not to deploy it due to testing and this "isn't a big deal".

Today MS completely changed their tune - here's the patch, deploy it at all costs. The dns guys have been working on this and been on the phone constantly since it was announced. I'm not slamming MS, but to have a complete about face tune like that is unusual.

I think the thing that is scaring people involved with the actual patching is the rate at which it is developing. A friend just got an email from cisco that another patch was coming out in just a day or two and that to use what they released already until then. Already on various forums I have read of people talking about ways to get around the current patches. Looks like they opened a can of worms.

 

[spidey07]

Originally posted by: aphex
Any chance this is related?

http://forums.anandtech.com/me...=2210695&enterthread=y

She's on Bellsouth DSL, vulnerable according to doxpara, we just switched her to Open DNS tonight.

Any unusual online activity could be related to this. Not saying it's the cause, I've done this network security crap for a living for 15 years and I'm not doing squat on the internet if it involves money/identity without very, very careful scrutiny. And even then for me, it's not worth risking it unless it's just credit card info.

 

[spidey07]

Originally posted by: Modelworks

Originally posted by: spidey07
Just to add from what our DNS guys were talking about today (yes, 6 people devoted to nothing but DNS).

Yesterday MS security "experts" told them they had a patch in the works for MS DNS servers, but not to deploy it due to testing and this "isn't a big deal".

Today MS completely changed their tune - here's the patch, deploy it at all costs. The dns guys have been working on this and been on the phone constantly since it was announced. I'm not slamming MS, but to have a complete about face tune like that is unusual.

I think the thing that is scaring people involved with the actual patching is the rate at which it is developing. A friend just got an email from cisco that another patch was coming out in just a day or two and that to use what they released already until then. Already on various forums I have read of people talking about ways to get around the current patches. Looks like they opened a can of worms.

Yeah, it's the protocol and RFC itself. Very similar to the BGP vulnerability a while ago.

 

[xanis]

anyone else having trouble getting on the doxpara site?

 

[Modelworks]

Originally posted by: Xanis
anyone else having trouble getting on the doxpara site?

I think it just can't handle the load.
Quick search showed that site has a almost 900% increase in traffic

 

[xanis]

Originally posted by: Modelworks

Originally posted by: Xanis
anyone else having trouble getting on the doxpara site?

I think it just can't handle the load.
Quick search showed that site has a almost 900% increase in traffic

Ah, I see. I'll try tomorrow morning.

 

[IEC]

Not sure if PDX area Qwest is vulnerable, so I switched to OpenDNS for the time being.

 

[IEC]

Originally posted by: Xanis
anyone else having trouble getting on the doxpara site?

I haven't been able to access that or the OARC test on either Qwest DNS or Open DNS.

 

[StarsFan4Life]

Originally posted by: Spartan Niner

Originally posted by: Xanis
anyone else having trouble getting on the doxpara site?

I haven't been able to access that or the OARC test on either Qwest DNS or Open DNS.

DDOS from the hackers already starting?

Going to sleep now, wonder if the internet will be up in the morning.

 

[IEC]

Originally posted by: StarsFan4Life

Originally posted by: Spartan Niner

Originally posted by: Xanis
anyone else having trouble getting on the doxpara site?

I haven't been able to access that or the OARC test on either Qwest DNS or Open DNS.

DDOS from the hackers already starting?

Going to sleep now, wonder if the internet will be up in the morning.

I was able to test doxpara on both DNS now. But yeah those two sites are getting HAMMERED.

 

[xanis]

I just got on doxpara and ran the test. Says I might be safe, but my NAT/Firewall is interfering... oi.

 

[StarsFan4Life]

It took all of but 48hours for DRUDGEREPORT to have an article about this. I figured as big as this is, it would have been a bigger story than Obama talking to Germans about rebuilding.....


http://www.breitbart.com/artic...rdnlz0a&show_article=1

 

[Crucial]

the opendns servers just took a crap for me. switched to another server I know and it's working fine now.

 

[imported_Champ]

So I have no understanding about what this really is but you guys are actually taking this seriously so it must be bad:shocked:

So I ran the test on doxpara and it said Your name server, at 64.xx.xxx.xxx, appears to be safe, but make sure the ports listed below aren't following an obvious pattern.

the it shows this request

83bc3baf835d.toorrr.com:

then my server number followed by TXID=xxxxx five times over

so is 83bc3baf835.toorrr.com the site or something i should be worried about because i dont know what that site is?

 

[RESmonkey]

Should we keep using OpenDNS ?

 

[ViRGE]

Originally posted by: Champ
So I have no understanding about what this really is but you guys are actually taking this seriously so it must be bad:shocked:

So I ran the test on doxpara and it said Your name server, at 64.xx.xxx.xxx, appears to be safe, but make sure the ports listed below aren't following an obvious pattern.

the it shows this request

83bc3baf835d.toorrr.com:

then my server number followed by TXID=xxxxx five times over

so is 83bc3baf835.toorrr.com the site or something i should be worried about because i dont know what that site is?

<characters>.toorrr.com is the domain that they're using to test with. What happens is that you're given a series of requests to run lookups on for randomly generated subdomains of toorrr.com (which they control). Their master DNS server then logs these requests coming from your ISP's DNS server (since it would need to go to the master for all of these new subdomains) and reports the data back to you. This way they can see exactly what ports and transaction IDs are being used. If there's little-to-no randomness, then someone can brute force fake transactions and poison your ISP's DNS server, and you are told that your ISP's DNS server is vulnerable.

If it says you're safe, then you're safe.

 

[ViRGE]

Originally posted by: spidey07
Just to add from what our DNS guys were talking about today (yes, 6 people devoted to nothing but DNS).

Yesterday MS security "experts" told them they had a patch in the works for MS DNS servers, but not to deploy it due to testing and this "isn't a big deal".

Today MS completely changed their tune - here's the patch, deploy it at all costs. The dns guys have been working on this and been on the phone constantly since it was announced. I'm not slamming MS, but to have a complete about face tune like that is unusual.

I thought MS had all of their related patches out and shipped on the 8th?

 

[RESmonkey]

Who is usually behind these DDOS and DNS exploits? What kind of hackers? I suppose way beyond "4chan" people?

 

[ViRGE]

Originally posted by: RESmonkey
Who is usually behind these DDOS and DNS exploits? What kind of hackers? I suppose way beyond "4chan" people?

You'd be primarily looking at fraudsters. The most obvious use of stealing a domain is to steal credentials and other data for fraudulent purposes. However you could also do it to effectively bring a site offline, or replace a site with faulty information (e.g. replace the content of Whitehouse.gov with a notice that WW3 has started). Some people may not even be above doing it just to mess with people.

 

[spidey07]

Originally posted by: ViRGE

Originally posted by: spidey07
Just to add from what our DNS guys were talking about today (yes, 6 people devoted to nothing but DNS).

Yesterday MS security "experts" told them they had a patch in the works for MS DNS servers, but not to deploy it due to testing and this "isn't a big deal".

Today MS completely changed their tune - here's the patch, deploy it at all costs. The dns guys have been working on this and been on the phone constantly since it was announced. I'm not slamming MS, but to have a complete about face tune like that is unusual.

I thought MS had all of their related patches out and shipped on the 8th?

MS may have, I'm not part of that group but they're my buddies. They (DNS guys) have been on the horn constantly with MS for probably two+ weeks now, 10 hours a day they're on the horn.

I'm not pointing fingers at MS, just the pointing out the shift in attitude from them the last 24-48 hours.

 

[RESmonkey]

Originally posted by: ViRGE

Originally posted by: RESmonkey
Who is usually behind these DDOS and DNS exploits? What kind of hackers? I suppose way beyond "4chan" people?

You'd be primarily looking at fraudsters. The most obvious use of stealing a domain is to steal credentials and other data for fraudulent purposes. However you could also do it to effectively bring a site offline, or replace a site with faulty information (e.g. replace the content of Whitehouse.gov with a notice that WW3 has started). Some people may not even be above doing it just to mess with people.

Well, if they do replace websites, they better screenshot it. I want to see it for the lulz.

 

[her209]

Originally posted by: StarsFan4Life

Originally posted by: Spartan Niner

Originally posted by: Xanis
anyone else having trouble getting on the doxpara site?

I haven't been able to access that or the OARC test on either Qwest DNS or Open DNS.

DDOS from the hackers already starting?

Going to sleep now, wonder if the internet will be up in the morning.

The Internet will be waiting.

It's just gone!

 

[Baked]

Looks like I'm gonna stay offline for the remainder of the month.

 

[randay]

Originally posted by: Baked
Looks like I'm gonna stay offline for the remainder of the month.

no real need for that, just dont shop or bank.

 

[Jeff7]

A question then about router setup:

In my router, it uses DHCP to get the WAN info for the cable modem. This includes the DNS settings. The only way to edit the DNS servers is to set it to use a static IP.

So then the question:
If I change the DNS settings on my PC's Networking section, will it use those DNS servers instead of the router's?