Overcoming a DNS Attack

Last summer Kaminsky outlined a flaw in DNS that could be used to make DNS cache poisoning attacks easier. The public comment period for the introduction of DNSSEC has ended, but it hasn’t been implemented yet. This weekend, I found myself unable to visit Yahoo! services when all the DNS entries came out wrong. Was it a DNS poisoning attack, or just a misconfiguration? I don’t know, but I wasn’t about to spend Sunday without my live Fantasy scores updating. Here’s how I worked around the problem, and how you could “fix” an attack against your favorite servers, too.

Open Source Investigation

No matter how hard I try, I cannot seem to convince some people just how powerful open source research is. Google is your friend, I say. Unless you’re trying to hide something, of course. But RJMetrics has put together a great demonstration of what you can discover by searching the Internet, and how he did it. It’s very enlightening, and hopefully inspiring enough to get you to solve whatever mystery has been bugged you lately.

Correction: WPA not cracked, merely fraying

In an update to yesterday’s post, it appears the new exploit doesn’t actually allow recovery of TKIP keys, but does allow decryption of shorter packets. Decryption of packets doesn’t sound too useful, but it does still allow injection of small downstream packets. Small downstream packets include… DNS and ARP messages. So while the exploit itself remains pretty much useless, it can provide that little hole to insert the lever of poisoning. The fact remains that users of WPA are vulnerable to attack. More details here.

The root source of the exploit? While WPA2 requires AES, WPA doesn’t require it… meaning DES is still in the standard. Whoops.

WPA Cracked. Film at 11.

Encryption isn’t measured in terms of “secure” or “non-secure,” at least by professional cryptographers. There’s exactly one provably secure cipher, and it’s such a pain to use you’ll rarely see it at all. Everything else is broken in time, either through advances in computing speed (brute force method) or mathematical breakthroughs. WPA has joined the ranks of the mathematically broken ciphers… sort of.