Researchers have released software that exploits the recently leaked flaw in the Internet's Domain Name System (DNS) software. That may mean IT admins are in for a long weekend of implementing and testing the patch.
IOActive researcher Dan Kaminsky discovered the bug earlier this month. The attack code was released Wednesday by developers of the Metasploit hacking toolkit, headed by the infamous HD Moore.
By exploiting this vulnerability, an attacker can redirect an ISP's users to a malicious phishing server  every time they try to visit a legitimate Web site. The patches released through various vendors should protect from the threat, but it may be a rush for some.
Understanding the Root of the Threat
The threat emerges from two different issues with the DNS protocol, according to McAfee Avert Labs. DNS primarily uses UDP packets to send questions and receive answers. The client will accept any packet as an answer to its question on three conditions: the packet is coming from the DNS server, the source and destination ports match the destination and source ports of the question packet and, most importantly, the transaction ID and question match its question.
"An attacker can spoof such an answer packet as long as he can pretend to be the DNS server and also guess the source port and transaction ID (the destination port is usually 53)," said Ravi Balupari, a security researcher at McAfee Avert Labs. "The attacker also needs to make sure his spoofed answer packet reaches the client before the actual answer packet from the legitimate DNS server."
Complicating matters, when a DNS server replies to a question, it can also include additional information in the answer to make future processes more efficient. Combining the answer packet spoof with the additional information makes the story more interesting because it makes exploitation easier.
In reality, Balupari said, a large number of attempts are required to guess the source port and the transaction ID of a DNS question before the victim's PC receives a legitimate answer from the DNS server. But other attacker strategies can help shorten the guesswork.
"If an attacker is successful in predicting the source port and transaction ID, and also inserts the additional information into the spoofed answer packet with the DNS servers pointing to the IP of his evil DNS server, he can control the traffic directed for bob.com domain," Balupari said. (continued...)
|
Rackspace: It makes a difference when you focus on support.
House Lawmakers Push Ban on Peer-to-Peer Software
GAO: Los Alamos Computer Security Has Weaknesses
Computer Security Firm Fortinet Plans IPO This Week
Flat Shipments Hurt Dell Despite Increased Earnings
New Pogoplug 'Personal Cloud' Does Social Networking
Apple Tablet Rumored Delayed as Publisher Gears Up
Smartphones: A Bigger Target for Security Threats
FBI Says Hackers Targeting Law Firms, PR Companies