Hackers could take over the Web

sudo apt-get update
sudo apt-get upgrade

*fixed*

I wondered why we had DNS related updates today.. around 800kb.

Guess its time to update bind on all my servers quickly.
 
Your name server, at 196.43.45.190, appears vulnerable to DNS Cache Poisoning.
All requests came from the following source port: 33874Requests seen for fe4213257f97.toorrr.com:
196.43.45.190:33874 TXID=8729
196.43.45.190:33874 TXID=40426
196.43.45.190:33874 TXID=23295
196.43.45.190:33874 TXID=65430
196.43.45.190:33874 TXID=20104
Click to expand...

Uhm, what does this mean? :D
 
Next thing we know they hack into all the ubuntu update servers and upload their evil scheming cracked-DNS and lable it as the patch :D
 
Your name server, at xxxxxxxxxxx, appears vulnerable to DNS Cache Poisoning.
All requests came from the following source port: 59684Requests seen for 094ef6fghfgh5a673c.toorrr.com:
Click to expand...

Update your DNS. Get your ISP to update its DNS. Though by now I am sure they know.
 
w1z4rd said:
Get your ISP to update its DNS. Though by now I am sure they know.
Click to expand...

Well I sincerely hope they know! :) I'm on SAIX and just did that DNS check on the DoxPara site as the article suggested and it says the DNS server is vulnerable, so Telkom's DNS servers clearly still need to be updated with the patch. Maybe RPM can officially inform them of the problem because I'm not convinced that Telkom reads all the necessary security bulletins. ;)

Your name server, at xxx.xxx.xxx.xxx, appears vulnerable to DNS Cache Poisoning.
Click to expand...
 
Does anyone know what exactly the vulnerability is and what it does. The article does not even attempt to explain.
 
astrauss said:
Does anyone know what exactly the vulnerability is and what it does. The article does not even attempt to explain.
Click to expand...

They are keeping info tight on the hole.. but here is one persons opinion

It's reasonably obvious from the CERT advisory how an attack would work. The CERT advisory tells us that the vulnerable systems are ones where the 16-bit DNS transaction ID and the 16-bit port number for a transaction are not randomly chosen. The CERT advisory also tells us that the attacker must be able to spoof IP addresses, that is, they must not be behind some ISP with egress filtering. CERT also tells us that it's a DNS poisoning attack.

So it looks like a form of this attack documented in 2003 [net-security.org] at "Cache Poisoning using DNS Transaction ID Prediction". Back in 2003, it took a large number of packets to make this attack work, and even then it wasn't reliable. But there may be a more cost-effective attack strategy if you know how the DNS server assigns transaction numbers and ports.

The fundamental problem comes from 1) the fact that source IP addresses can be forged, and 2) the DNS transaction ID, at 16 bits, is far too short to be considered a useful random key. Any key with security implications should be at least 64 bits and be generated by a crypto-grade random number generator.
Click to expand...
 
I just did the test and also am on SAIX Telkom.

Guess what, my name server is vulnerable to DNS cache poisoning, big surprise.

So how do we get Telkom (and other ISPs) to resolve this issue?

Is using OpenDNS perhaps an option till Telkom sorts itself out?
 
Geeze you guys seem to be taking this lightly, I realise it's unlikely for there to be problems, due to safety in numbers if nothing else,But surely this issue is worth addressing?
 
Threepwood said:
Geeze you guys seem to be taking this lightly, I realise it's unlikely for there to be problems, due to safety in numbers if nothing else,But surely this issue is worth addressing?
Click to expand...

Im taking it very seriously. Updating everything.
 
w1z4rd said:
Im taking it very seriously. Updating everything.
Click to expand...

Glad I'm not the only one worrying. I posted this previously in this thread:

I just did the test and also am on SAIX Telkom.

Guess what, my name server is vulnerable to DNS cache poisoning, big surprise.

So how do we get Telkom (and other ISPs) to resolve this issue?

Is using OpenDNS perhaps an option till Telkom sorts itself out?
Click to expand...

So what to do about this? I switched to OpenDNS but I get the same message.

Other than that I guess we just update all our browsers and get security patches for our OS?
 
You must log in or register to reply here.
Back
Top
Sign up to the MyBroadband newsletter
X