About DNS Cache Poison

Editor's note: this is already a cutting-edge article.

Author: strong winds

After a cool weekend (I usually don't go online in my spare time), I ran back and saw that there were still overwhelming DNS vulnerabilities on the Internet.

There are too many hypes to write this vulnerability. Recently, it seems that everyone's blogs hate to write one or two pieces of this vulnerability to express their own attention and attention.

At present, there are three exploit modules, one of which is ruby's earliest and one of the modules of hd moore's metasploit 3. The next is python, and the last is the implementation of C coming out today.

In fact, I think everyone is most concerned about the success rate. Yun Shu wrote a lot of articles and analyzed it. The final conclusion is that this is a YY vulnerability. Because real src port needs to be guessed and QID needs to be guessed, it is a problem similar to the competition condition. It should be done before the real name server responds, so the probability is not very high.

However, after completing this operation, you can re-specify the nameserver so that you can use the entire domain name of poison, such as yahoo.com. Therefore, the value is very high. The problem returns to the success rate, even if the probability is small, as long as it can be successful once, it takes a long time to improve the success rate.

However, looking at foreign discussions over the past few days, it seems that the situation is better than Yun Shu's imagination.

The first is the method for calculating the success rate on DD.

Assume the following symbols are used:

I: Number distinct IDs available (maximumum 65536)

P: Number of ports used (maximum around 64000, but often 1)

N: Number of authoritative nameservers for a domain (averages
Around 2.5)

F: Number of fake packets sent by the attacker

R: Number of packets sent per second by the attacker

W: Window of opportunity, in seconds. Bounded by the response
Time of the authoritative servers (often 0.1 s)

D: Average number of identical outstanding questions of a resolver
(Typically 1, see Section 5)

A: Number of attempts, one for each window of opportunity

The probability of spoofing a resolver is equal to amount of fake packets that arrive within the window of opportunity, divided by the size of the problem space.

When the resolver has D multiple identical outstanding questions, each fake packet has a proportionally higher chance of matching any of these questions. This assumption only holds for small values of D.

In symbols, if the probability of being spoofed is denoted as P_s:

P_s = D * F/N * P * I

It is more useful to reason not in terms of aggregate packets but to convert to packet rate, which can easily be converted to bandwidth if needed.

If the Window of opportunity length is W and the attacker can send R packets per second, the number of fake packets F that are candidates to be accepted is:

F = R * W ---> P_s = D * R * W/N * P * I

To calculate the combined chance of at least one success, the following formula holds:

P_cs = 1-(1-P_s) ^ A = 1-(1-D * R * W/N * P * I) ^

When common numbers (as listed abve) for D, W, N, P and I are inserted, this formula reduces t

P_cs = 1 (1-R/1638400) ^

The different between this attack and the one described in the original study (http://www.faqs.org/ftp/internet-drafts/draft-hubert-dns-anti-spoofing-00.txt) is in the number.

In the original study, A = T/TTL, where T is the time taken to successful poison target resolvers, and TTL is the number of seconds when the target hostname expires. in other words, each time we fail to poison, we must have to wait for TTL second before trying again.

In this case, A = N, which is the number of queries we send to target resolvers. this is because we dont have to wait any second even if we fail to poison in all previous attempts. remember the CNAME trick abve?

So all you must do now is to increase R and. suppose for each query, you send F = 30 fake responses to target resolvers in W = 0.1, hence your bandwidth shocould be R = F/W = 300 packet/s. if A = 4000, then you stand a 51% chance to be sucessful! Its that easy.

If you use Metasploit, you can use the following formula to calculate your probability:

P_cs = 1-(1-xids/2 ^ 16) ^

Where xids is the number of fake responses you want to send for each query. remember to consider your bandwidth capacity when choosing xids. if you choose the default value, I. e. xids = 10, then you can perform CT to poison successful after A> 4000.

One final note: this attack is not a birthday attack. because we only have one opening query to guess its QID.

Then, the author of the C language version exploit said that his success rate was also very high and it could be done within 80 seconds.

So I rewrote the attack in C and was about to publish it when I noticed that Druid and HDM just released their metasploit module. I have not had the time to compare the 2 but in case anybody is interested, here it is:

$. Minsky-attack q. q r. r a. a. a 1234 pwned example.com.
1.1.1.1 8192 16

This shoshould cause a pwned.example.com A record resolving to 1.1.1.1 to appear in r. r. r. rs cache. the chance of successfully locking oning the resolver with this example (8192 attempts and 16 replies/attempt) is 86% (1-(1-16/65536) ** 8192 ).
This example also requires a bandwidth of about 2.6 Mbit/s (16 replies/attempt *~ 200 bytes/reply * 100 attempts c * 8 bits/byte) and takes about 80 secs to complete (8192 attempts/100 attempts c ).

Things cocould clearly be optimized, eg. by using label compression in the DNS packets (oh and dont comment on the quality of the code-it was rushed: P ), but I am very interested to see how Kaminsky got it down to "10 secs on a fast Internet link" (does he mean 10 + Mbit/s, or is he using other more advanced tricks ?)

-Marc

This vulnerability has seen too many people, so it is inconsistent with my usual YY style, so I am not interested in researching it. However, I don't think we should make a conclusion whether Dan has any new method to quickly guess QID. rigorous attitude is necessary for study.