Re: [Full-disclosure] New Vulnerability against Firefox/ Major Extensions

On 5/30/07, Steven Adair <steven@xxxxxxxxxxxxxxxx> wrote:
We are also at risk from rogue developers, people that have
hacked/poisoned your trusted DNS provider, those that have modified your
/etc/hosts, /etc/resolv.conf, windows\system32\drivers\etc\hosts (and/or
related files), people that have hacked the update server and put there
own malicious version there, and the unlocked workstation attack from an
attacker with a USB flash drive with a malicious update that might sit
down at your workstation and -pwn- you.

Or, more simply, from a brute-force poisoning attack that doesn't
involve compromising the trusted DNS provider at all. It's been known
for *at least as long as I've been in this business* that DNS is *not*
secure, even when both the DNS server and the requesting client are
not compromised. There's no significant authentication of the DNS
server's reply, so DNS responses can be trivially spoofed by an
attacker who knows a window of time wherein you might request the
address of a particular host.

An example of such a condition: scheduled automatic updates. That
just happens to be exactly what is described here. You do the math.

This really should have been articulated in the original advisory,
IMO. When applications depend on DNS for trust decisions, virtually
*every* internet connection is untrusted.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • (somewhat) breaking the same-origin policy by undermining dns-pinning
    ... to portscan the lan to locate intranet http servers, ... tweaking, it is also possible for the script to obtain read access, ... The basis of the attack is rather old. ... After the script has been downloaded, the attacker modifies the DNS ...
    (Bugtraq)
  • RE: Re[2]: Windows DNS Cache Poisoning by Forwarder DNS Spoofing
    ... The birthday attack actually dates back to at least 1997, ... why is this report a report of a Windows DNS ... BIND in his test scope or something like that. ... RAG> How does BIND stop this sort of attack? ...
    (Bugtraq)
  • [REVS] DNS Amplification Attacks
    ... DNS Amplification Attacks ... One of the networks under attack indicated some ... exploited name servers. ...
    (Securiteam)
  • CAIS-ALERT: Vulnerability in the sending requests control of BIND
    ... experiments with several versions of the Internet Software Consortium's ... possibility of successful DNS Spoofing attacks to versions 4 and 8. ... The attack goal is to anticipate a reply with false information to the ... target DNS server, making the server to store in its cache a false IP ...
    (Bugtraq)
  • RE: CAIS-ALERT: Vulnerability in the sending requests control of BIND
    ... What I am saying is that the attack you mention is a variation ... Namely that there is a fundamental design flaw than makes DNS ... why ISC and the "official" BINd did not incorporate this and kept ... > the next queries generated by DNS.TARGET.COM will have query IDs that will ...
    (Bugtraq)