DNS Exploit in the Wild

[randay]

Originally posted by: Jeff7
A question then about router setup:

In my router, it uses DHCP to get the WAN info for the cable modem. This includes the DNS settings. The only way to edit the DNS servers is to set it to use a static IP.

So then the question:
If I change the DNS settings on my PC's Networking section, will it use those DNS servers instead of the router's?

yes

 

[DisgruntledVirus]

Well work hasn't fixed their DNS servers. We still are using "bad" DNS servers lol.

 

[bignateyk]

Is this why over the last few days when I go to certain pages (google, comcast, etc...) it will give me an error message about DNS? I will try to go and it will show an error page telling me I should set it to automatically detect DNS or something, then I try to go to it an hour later and it works just fine.

My ISP is comcast BTW.

 

[Anubis]

Originally posted by: DisgruntledVirus
Well work hasn't fixed their DNS servers. We still are using "bad" DNS servers lol.

i tested my works today we seem to be fine, i was fine at my house yesterday but i allready was useing level 3's DNS servers and not TWCs

 

[StarsFan4Life]

Whew.....internet is stil up...

No need to go out Californiway.....

 

[PlatinumGold]

Originally posted by: StarsFan4Life

Originally posted by: OdiN

Originally posted by: StarsFan4Life

Originally posted by: Gooberlx2
Still vulnerable. I wonder if our IT dept even knows about this.

Was this referenced to me?

I sure hope you aren't part of any IT department.

Well I am and don't appreciate these comments. Just because I am part of an IT department, doesn't mean I know everything. I love to learn though.

:roll:

if you really love to learn, you would have done some research on your own. i mean seriously, asking how to put dns server setting into a router? sure, i understand asking those questions if you are not in IT, but claiming to work for an IT department and not know enough to figure out on your own how to put DNS SERVER SETTINGS manually into a router or even know where to do it is unforgivable.

big time :roll:

 

[StarsFan4Life]

Originally posted by: PlatinumGold

Originally posted by: StarsFan4Life

Originally posted by: OdiN

Originally posted by: StarsFan4Life

Originally posted by: Gooberlx2
Still vulnerable. I wonder if our IT dept even knows about this.

Was this referenced to me?

I sure hope you aren't part of any IT department.

Well I am and don't appreciate these comments. Just because I am part of an IT department, doesn't mean I know everything. I love to learn though.

:roll:

if you really love to learn, you would have done some research on your own. i mean seriously, asking how to put dns server setting into a router? sure, i understand asking those questions if you are not in IT, but claiming to work for an IT department and not know enough to figure out on your own how to put DNS SERVER SETTINGS manually into a router or even know where to do it is unforgivable.

big time :roll:

Dude...seriously...who gives a shit.

Networks are not my thing.

Let's all bow to the almighty PlatinumGold for knowing all. I'm positive there was NEVER a time when you didn't know everything.

 

[Anubis]

Originally posted by: PlatinumGold

Originally posted by: StarsFan4Life

Originally posted by: OdiN

Originally posted by: StarsFan4Life

Originally posted by: Gooberlx2
Still vulnerable. I wonder if our IT dept even knows about this.

Was this referenced to me?

I sure hope you aren't part of any IT department.

Well I am and don't appreciate these comments. Just because I am part of an IT department, doesn't mean I know everything. I love to learn though.

:roll:

if you really love to learn, you would have done some research on your own. i mean seriously, asking how to put dns server setting into a router? sure, i understand asking those questions if you are not in IT, but claiming to work for an IT department and not know enough to figure out on your own how to put DNS SERVER SETTINGS manually into a router or even know where to do it is unforgivable.

big time :roll:

stop being a tool, just because someone works in IT does not automatically mean they know the inner workings of some off the shelf router

 

[StarsFan4Life]

Originally posted by: Anubis

Originally posted by: PlatinumGold

Originally posted by: StarsFan4Life

Originally posted by: OdiN

Originally posted by: StarsFan4Life

Originally posted by: Gooberlx2
Still vulnerable. I wonder if our IT dept even knows about this.

Was this referenced to me?

I sure hope you aren't part of any IT department.

Well I am and don't appreciate these comments. Just because I am part of an IT department, doesn't mean I know everything. I love to learn though.

:roll:

if you really love to learn, you would have done some research on your own. i mean seriously, asking how to put dns server setting into a router? sure, i understand asking those questions if you are not in IT, but claiming to work for an IT department and not know enough to figure out on your own how to put DNS SERVER SETTINGS manually into a router or even know where to do it is unforgivable.

big time :roll:

stop being a tool, just because someone works in IT does not automatically mean they know the inner workings of some off the shelf router

Thank you!

Now back to topic at hand here.

 

[PlatinumGold]

Originally posted by: StarsFan4Life

Originally posted by: Anubis

Originally posted by: PlatinumGold

Originally posted by: StarsFan4Life

Originally posted by: OdiN

Originally posted by: StarsFan4Life

Originally posted by: Gooberlx2
Still vulnerable. I wonder if our IT dept even knows about this.

Was this referenced to me?

I sure hope you aren't part of any IT department.

Well I am and don't appreciate these comments. Just because I am part of an IT department, doesn't mean I know everything. I love to learn though.

:roll:

if you really love to learn, you would have done some research on your own. i mean seriously, asking how to put dns server setting into a router? sure, i understand asking those questions if you are not in IT, but claiming to work for an IT department and not know enough to figure out on your own how to put DNS SERVER SETTINGS manually into a router or even know where to do it is unforgivable.

big time :roll:

stop being a tool, just because someone works in IT does not automatically mean they know the inner workings of some off the shelf router

Thank you!

Now back to topic at hand here.

topic hand, exactly, shouldn't be about, oh, can someone please hold my hand and help me step by step putting dns server settings in my router. :roll:. it would have taken you all of 30 seconds to do a google search on the brand of your router and found more than enough documentation to take you thru how to do it.

my problem isn't with ignorance, it's that you are unwilling to do a little work on your own to figure it out. this is no different than high school kids posting math problems so that we can help them with their homework. that is frowned upon here, i'm surprised this isn't.

 

[StarsFan4Life]

Originally posted by: PlatinumGold

Originally posted by: StarsFan4Life

Originally posted by: Anubis

Originally posted by: PlatinumGold

Originally posted by: StarsFan4Life

Originally posted by: OdiN

Originally posted by: StarsFan4Life

Originally posted by: Gooberlx2
Still vulnerable. I wonder if our IT dept even knows about this.

Was this referenced to me?

I sure hope you aren't part of any IT department.

Well I am and don't appreciate these comments. Just because I am part of an IT department, doesn't mean I know everything. I love to learn though.

:roll:

if you really love to learn, you would have done some research on your own. i mean seriously, asking how to put dns server setting into a router? sure, i understand asking those questions if you are not in IT, but claiming to work for an IT department and not know enough to figure out on your own how to put DNS SERVER SETTINGS manually into a router or even know where to do it is unforgivable.

big time :roll:

stop being a tool, just because someone works in IT does not automatically mean they know the inner workings of some off the shelf router

Thank you!

Now back to topic at hand here.

topic hand, exactly, shouldn't be about, oh, can someone please hold my hand and help me step by step putting dns server settings in my router. :roll:. it would have taken you all of 30 seconds to do a google search on the brand of your router and found more than enough documentation to take you thru how to do it.

my problem isn't with ignorance, it's that you are unwilling to do a little work on your own to figure it out. this is no different than high school kids posting math problems so that we can help them with their homework. that is frowned upon here, i'm surprised this isn't.

Last time I checked, this was a computer forum, not a math problem forum. So I guess someone asking "what is RAM" is frowned upon here too? I thought the quality of questions and answers around here didn't matter. We are all here to learn and share information. Obviously you are not.

Thanks to all that have helped me and every "ignorant" person on these forums.

Get over it already man...

 

[geokilla]

Guys help. I tried checking my DNS thingy from the site in the first post, but I can't seem to open the webpage. If the webpage works and I click check my DNS, it doesn't load. Does this mean my DNS server is affected?

 

[ElFenix]

This is not a thread for flaming. And get your nested quotes under control.

ATOT Moderator ElFenix

 

[ViRGE]

Originally posted by: geokilla
Guys help. I tried checking my DNS thingy from the site in the first post, but I can't seem to open the webpage. If the webpage works and I click check my DNS, it doesn't load. Does this mean my DNS server is affected?

It's probably due to load. If you're on Firefox and have NoScript installed, that can also cause problems.

 

[Lifted]

Had to email my ISP about this. They emailed me back within an hour stating the DNS server was patched. So much for testing. :roll:

Anyway, maybe somebody could think this through a bit better than I can...

If a record was successfully poisoned, is there any way for the false site to use SSL without any warning dialogs popping up in the browser (assuming they haven't been disabled)?

If the phishing site is hosted at 123.123.123.123 and has people thinking they are at www.mybank.com, and they use SSL so as not to make people suspicious and keep the scam going longer, all browsers will display a warning that the domain in the SSL cert (gimmieyourbankaccount.com) is not the same site as the domain in the browser (mybank.com).

Is there any way for them to get around this? If SSL is still safe then those who are aware enough to check that they are using a secure connection before logging in anywhere should still be safe.

 

[RESmonkey]

Originally posted by: Lifted
Had to email my ISP about this. They emailed me back within an hour stating the DNS server was patched. So much for testing. :roll:

Anyway, maybe somebody could think this through a bit better than I can...

If a record was successfully poisoned, is there any way for the false site to use SSL without any warning dialogs popping up in the browser (assuming they haven't been disabled)?

If the phishing site is hosted at 123.123.123.123 and has people thinking they are at www.mybank.com, and they use SSL so as not to make people suspicious and keep the scam going longer, all browsers will display a warning that the URL in the SSL cert (www.gimmieyourbankaccount.com) is not the same site as the URL in the browser (www.mybank.com).

Is there any way for them to get around this? If SSL is still safe then those who are aware enough to check that they are using a secure connection before logging in anywhere should still be safe.

I believe that's similar to the warning I got from Firefox. It distinguished the checkout site from the site that I was being redirected to right after.

 

[spidey07]

Originally posted by: Lifted
Had to email my ISP about this. They emailed me back within an hour stating the DNS server was patched. So much for testing. :roll:

Anyway, maybe somebody could think this through a bit better than I can...

If a record was successfully poisoned, is there any way for the false site to use SSL without any warning dialogs popping up in the browser (assuming they haven't been disabled)?

If the phishing site is hosted at 123.123.123.123 and has people thinking they are at www.mybank.com, and they use SSL so as not to make people suspicious and keep the scam going longer, all browsers will display a warning that the domain in the SSL cert (gimmieyourbankaccount.com) is not the same site as the domain in the browser (mybank.com).

Is there any way for them to get around this? If SSL is still safe then those who are aware enough to check that they are using a secure connection before logging in anywhere should still be safe.

Yes, have access the the certificate file. But if they have that you're screwed.

Or change your browsers certificate trust list to trust your bogus cert, this is how you do SSL proxying and monitoring.

SSL is still safe as long as you check the cert and provided you have not malware on your machine that has modified your browsers cert trust list.

 

[Lifted]

Originally posted by: spidey07

Yes, have access the the certificate file. But if they have that you're screwed.

Or change your browsers certificate trust list to trust your bogus cert, this is how you do SSL proxying and monitoring.

SSL is still safe as long as you check the cert and provided you have not malware on your machine that has modified your browsers cert trust list.

Clearly if you machine is compromised or they get hold of the original cert these things are possible, but we should stay focused on the security implications of DNS cache poisoning alone as that's the easiest flaw to exploit which effects the largest number of people (it's also the question I asked ).

 

[MmmSkyscraper]

OpenDNS FTW.

 

[nordloewelabs]

ok, this has been asked before but noone answered the posters, so i'll give it a try and ask it again. this is the reply i get from http://www.doxpara.com:

Your name server, at xxx.xxx.xxx.xxx, may be safe, but the NAT/Firewall in front of it appears to be interfering with its port selection policy. The difference between largest port and smallest port was only 46.

i'm glad it says "i'm safe", however i'm curious about the bits that say there's an interference with "port selection policy" and the "difference between the ports".

the from http://entropy.dns-oarc.net/test gives me:

xx.xx.xx.xx appears to have POOR source port randomness and GREAT transaction ID randomness.

so my question is, is it GOOD, OK or BAD? i can tell it isnt optimal! :-s any way i can improve my security?

 

[spidey07]

That's fine, many SOHO routers or other NAT (really port address translation) devices just increment the source port by one for each subsequent connection no matter what the traffic/application.

 

[randay]

Originally posted by: nordloewelabs
ok, this has been asked before but noone answered the posters, so i'll give it a try and ask it again. this is the reply i get from http://www.doxpara.com:

Your name server, at xxx.xxx.xxx.xxx, may be safe, but the NAT/Firewall in front of it appears to be interfering with its port selection policy. The difference between largest port and smallest port was only 46.

i'm glad it says "i'm safe", however i'm curious about the bits that say there's an interference with "port selection policy" and the "difference between the ports".

the from http://entropy.dns-oarc.net/test gives me:

xx.xx.xx.xx appears to have POOR source port randomness and GREAT transaction ID randomness.

so my question is, is it GOOD, OK or BAD? i can tell it isnt optimal! :-s any way i can improve my security?

its "ok", switch your dns to one thats more secure. a lot of people have been suggesting opendns and thats what ive been using.

 

[Medea]

DNS Cache Poisoning Public Exploit Code Available

 

[duragezic]

Originally posted by: spidey07
Modelworks - read my post up above. A LOT of banking/credit card/shopping sites the main page is not SSL and there is an area to enter your username/pass. Of course the username/pass is sent with SSL on the real site and the next page is SSL as well.

So all I gotta do is slap up a page identical to the banks, your browser will show http://www.usbank.com but your connected to my web server, not the banks. Then you enter your username/pass, now I has it.

There is no way to tell if the site is legit or not this way

Exactly. I just heard of this exploit now. Last night I was running some numbers on my finances so I was hitting my bank and both credit card sites. I just checked and the certificate for my credit union and Discover looks legit, but the login page for Chase isn't SSL secure (the page itself), so I can't tell. Doxpara said I should be safe, hopefully that is true.

I'm on TWC RoadRunner in New York.

 

[Lifted]

Originally posted by: duragezic

Originally posted by: spidey07
Modelworks - read my post up above. A LOT of banking/credit card/shopping sites the main page is not SSL and there is an area to enter your username/pass. Of course the username/pass is sent with SSL on the real site and the next page is SSL as well.

So all I gotta do is slap up a page identical to the banks, your browser will show http://www.usbank.com but your connected to my web server, not the banks. Then you enter your username/pass, now I has it.

There is no way to tell if the site is legit or not this way

Exactly. I just heard of this exploit now. Last night I was running some numbers on my finances so I was hitting my bank and both credit card sites. I just checked and the certificate for my credit union and Discover looks legit, but the login page for Chase isn't SSL secure (the page itself), so I can't tell. Doxpara said I should be safe, hopefully that is true.

I'm on TWC RoadRunner in New York.

In this instance it would be best to navigate to an SSL page that before logging in. If that is not possible, complain to your bank and/or open an account at a new bank that understands security.

Banks that have login via non SSL pages clearly don't understand that SSL certs are also used to verify ones identity, which means that of all the people working on the banks website, not a single one has a clear understanding of this. Not a good sign in my opinion.