Comments on: Dan Kaminsky Disqualified from Most Overhyped Bug Pwnie

By: Zero Day mobile edition

Zero Day mobile edition — Tue, 22 Jul 2008 14:09:54 +0000

[...] Thomas Ptacek (right), principal of Matasano Security, was the first to call BS on the secrecy. Kaminsky immediately arranged a private conference call to spill the beans. Dino Dai Zovi, another researcher with hacker cred, was included. After the call, both Ptacek and Dai Zovi confirmed this was something super-serious that required immediate attention. [...]

By: Lynn Taylor

Lynn Taylor — Tue, 15 Jul 2008 00:18:40 +0000

Dan: thanks for your help.

By: Lynn Taylor

Lynn Taylor — Mon, 14 Jul 2008 23:17:17 +0000

Dan,

I’ve posted two comments at DoxPara.com, those comments are marked “waiting moderation” — and the E-Mail address is valid.

I promise to take the minimum amount of time.

Thanks — Lynn

By: JohnJones

JohnJones — Mon, 14 Jul 2008 21:20:24 +0000

thanks I know randomness is hard (-;

regards

John Jones
http://www.johnjones.me.uk

By: Dan Kaminsky

Dan Kaminsky — Mon, 14 Jul 2008 18:16:25 +0000

Tell me about the name server you’re coding against, and contact me privately.

By: Ma petite parcelle d'Internet...

Ma petite parcelle d'Internet... — Sat, 12 Jul 2008 08:57:18 +0000

DNS, DNS, DNS……

Germaine, sort le deux-coups, le riz, les boites de cassoulet, les bouteilles d’eau et les sacs de sable, l’Internet mondial est en train de sombrer. À pic. Façon Titanic. Et oui chers lecteurs, DNS vient de prendre un coup de douze. Un autre…….

By: Lynn Taylor

Lynn Taylor — Fri, 11 Jul 2008 19:38:29 +0000

As someone who was not part of the discussion in the DNS community, but still has to maintain (i.e. write code) for a DNS server, I’d still like to know what I’m coding against.

I understand (and respect) what Dan has done, but it was hard to find the details of the patch among all of the discussion.

I hope I’ve interpreted it correctly.

… and I hope I got it right.

By: Consensus? : DoxPara Research

Consensus? : DoxPara Research — Fri, 11 Jul 2008 07:51:01 +0000

[...] It went well. [...]

By: SecurityBob

SecurityBob — Thu, 10 Jul 2008 18:30:31 +0000

Let’s make the world believe that http://www.google.com is 127.0.0.1 :

Step 1:

- Create a malicious DNS zone (malicious.com)

- Spread links to http://www.malicious.com all over the internet (spam, etc…)

Step 2:

- Victim clicks on the the link to http://www.malicious.com

- Victim’s DNS resolver (ns.victim.com) talks to ns.malicious.com

- ns.malicious.com answers by saying that “www.malicious.com” really is an alias for “www.google.com”

=> At this point, I, as an attacker, knows that ns.victim.com is going to ask ns.google.com what is the IP of “www.google.com”

=> ns.victim.com is using either a fixed or a non-random UDP source port for its queries

=> So I can flood ns.victim.com (posing as ns.google.com) with tons of fake DNS answers claiming that http://www.google.com is 127.0.0.1. All I have to figure out at this point is the XID that will be used, and given that it’s a 16 bits integer, it’s not the most complex thing of the world.

=> ns.malicious.com now believes that http://www.google.com is 127.0.0.1