DNS cache poisoning attacks exploited in the wild

Numerous independent sources are starting to see evidence of DNS cache poisoning attempts on their local networks, in what appears to be an attempt to take advantage of the "recent" DNS cache poisoning vulnerability :

" client 143.215.143.11 query (cache) 'www.ebay.com/ANY/IN' denied: 31
Time(s)
client 143.215.143.11 query (cache) 'www.facebook.com/ANY/IN'
denied: 30 Time(s)
client 143.215.143.11 query (cache) 'www.gmail.com/ANY/IN' denied:
30 Time(s)
client 143.215.143.11 query (cache) 'www.google.com/ANY/IN' denied:
30 Time(s)
client 143.215.143.11 query (cache) 'www.live.com/ANY/IN' denied: 30
Time(s)
client 143.215.143.11 query (cache) 'www.microsoft.com/ANY/IN'
denied: 30 Time(s)
client 143.215.143.11 query (cache) 'www.msn.com/ANY/IN' denied: 30
Time(s)
client 143.215.143.11 query (cache) 'www.myspace.com/ANY/IN' denied:
30 Time(s)"

Surprised? I'm not, since this was pretty logical given that the three publicly available exploits have been downloaded over 15,000 times in the last couple of days. What I'm actually surprised of is that it took so long to produce a working exploit, and the despite the media outbreak raising awareness on the potential for abuse, major international and local ISPs remain vulnerable. Ironically, remain vulnerable just like they've always been even though patches for a particular vulnerability were available. Insecure and misconfigured DNS servers were, and continue to be a realistic threat even in a Web 2.0 world.

Take for instance a survey of DNS security conducted back in 2004, showing that :

"We next examine which names depend on nameservers with known security flaws. Of the 166771 nameservers, 27141 have known vulnerabilities. These vulnerabilities affect 185802 names. A naive expectation might be that, with ~17% vulnerable nameservers, only 17% of the names would be affected. This is patently not the case; transitive trust relationships "poison" every path that passes through an insecure nameserver. Hence 34% of DNS names can be compromised by launching well-known, scripted attacks. "

Another DNS measurement study conducted back in 2005, showed that 84% of Internet name servers could be vulnerable to pharming attacks. Even if you're more conservative than you should be, you can easily consider that at least 50% of Internet name servers remain vulnerable three years later. Well, that seems to be the case according to last year's survey of DNS security, again conducted by Infoblox :

"Still more than 50% of Internet name servers allow recursive queries, which is consistent with 2006 results. Accepting recursive queries from arbitrary addresses allows servers to be used in DNS amplification attacks that can bring down major networks, and also leaves them vulnerable to cache poisoning attacks. The percentage of name servers that allowed us to transfer zones actually increased slightly, from 29% to 31%. While this change is probably within the survey's margin of error, it does show that this aspect of security isn't improving. A change in the default behavior of the BIND 9 name server (like the change to the default recursion setting introduced in BIND 9.4) might help here."

Moreover, the MIT's IP Spoofer project originally running since 2005, continues to automatically generate graphs representing the state of DNS servers security across the globe, particularly their susceptibility to IP spoofing, the ABC of DNS security. Despite the hype over the recent vulnerability, DNS cache poisoning has been around for years, and it's not going away anytime soon.

Most importantly, malicious attackers don't need to take advantage of this flaw to successfully commit cybercrime like they do on a daily basis. What hasn't been taken care of for years, wouldn't be solved in a matter of days, that's for sure. Until then, take control of the situation, check whether or not your ISP is running DNS servers susceptible to cache poisoning, approach them in between sharing your evidence online, and consider going through the possible abuse scenarios malicious attackers can take advantage of using DNS cache poisoning.

tags: hacking ,DNS, VIRUS, NETWORK Security,IP , ROUTING

Passports worth £2.5 million stolen in van hijack |

Graham Tibbetts of the UK Telegraph is reporting that the British Foreign Office has admitted to losing around 3,000 passports and visa stickers, which were stolen on their way from Manchester to RAF Northolt in London, where they were to be sent to British embassies. From the article:

 Officials claimed the chip technology incorporated in the passports would prevent them being used.

 But fraud experts said they could be easily cloned and sold on the black market.

Apparently the driver of a vehicle being used to transport the passports had stopped to buy a “newspaper and chocolate bar, leaving a deliveryman in the vehicle.” At this point, robbers jumped into the van and attacked the man inside. The vehicle was stolen and later abandoned, with the deliveryman still on board. From the article:

 When he felt it was safe the worker, who suffered minor head and shoulder injuries, got out of the van and found that 24 cardboard boxes had been taken.

 He told police he did not know how many raiders were involved because he was forced to keep his head down. One witness said they saw two robbers jump in the van.

DCI Bill McGreavy of Greater Manchester Police said the passports would have been worth £2.5 million on the blackmarket.

On who’s to blame, the article goes on:

Passports are usually transported by the Home Office, which has a policy of using secure armoured vehicles

 But because the papers were to be sent overseas they were the responsibility of the Foreign Office.

 A spokesman at the FCO said they had launched an “urgent investigation” into security arrangements.

“We can confirm that a van was hijacked while en route from a production site in Manchester,” she said. “It contained 24 parcels of [blank] passports and visa vignettes.

“Both the passports and the vignettes have security features to prevent them being used.


“This is the first incident of its kind and we are carrying out an immediate review of security.

“We have a contract with a security firm. Drivers are not allowed to make unauthorised stops.”

The spokesman added that the Identity and Passport Service (IPS), part of the Home Office, had taken “further measures” to prevent the documents being used.

The article describes the security features of passports, or lack thereof, and interviews noted security research Adam Laurie on the subject:

The passports were the new electronic variety which contain a chip replicating the data printed on the document itself. They include personal details and a facial image of the holder.

However, analysts said they were easy to clone.

Adam Laurie, an independent consultant, said: “One of the problems with the passports is that there are no security features to stop their cloning. If you’ve got a genuine passport, dropping in a replacement chip is trivial.”

He advised taking the official claims on their usability “with a massive pinch of salt”.

It will be interesting to see if this was a targeted attack, or simply an attack of opportunity.
-Nate

Blogged with the Flock Browser

Be Indian, buy British is the new business mantra

Be Indian, buy British is the new business mantraTue, Jul 29 08:17 AMLondon, July 29 (IANS) Indian businesses are now spending more on buying businesses in Britain than in any other country, according to new analysis by leading financial and business adviser Grant Thornton.Britain tops the list of destination for offshore acquisitions by Indian companies, according to Grant Thornton's newly launched India Watch research, which monitors the India-Britain business relationship through both cross-border M and amp;A trends and the performance of Indian companies on the London Stock Exchange.The sale of Jaguar and Rover to Tata Motors helped to boost the total value of Indian acquisitions to 1.52 billion pounds in the first half of the year, compared with 930 million pounds in the US and 561 million pounds in the Netherlands.The US, however remains the number one destination by number of companies acquired, with 41 American businesses purchased by Indian companies in the first half of 2008, compared with 20 British companies.At the other end of the scale from the Tata deals is the purchase of stockbroker Hichens Harrison and amp; Co. Plc. by India's Religare Capital Markets Ltd. for 50 million pounds, demonstrating the diversity of British firms now targeted by Indian interests.Anuj Chande, head of Grant Thornton's South Asia Group, said the interest was due to a combination of historical ties, strong cross border business links and infrastructure, a very compatible business ethos and the fact that many British firms' values have fallen.On the other hand, Indian firms are flush with cash after a period of rapid economic growth, and are buying more foreign companies than ever. In 1998 there were a total of 15 companies purchased offshore by Indian companies; in the first six months of this year there have already been 161 acquisitions.'Indian businesses are looking primarily looking to buy brands and established distribution networks. If a UK brand with an international profile is looking for buyers, expect interest from acquisitive India companies. This is a nation forging ahead with buy-and-build on a massive scale,' said Chande, who worked on the Tata deal.UK companies were also on the acquisition trail in India in the first part of 2008, with 487 million pounds spent on 23 companies - although this is significantly down on last year's record breaking pound9.56 billion in total British acquisitions in India.Deals included the acquisition of IL and amp;FS Investsmart Ltd, a financial management firm, by HSBC Holdings Ltd for pound123 million and Thomas Cook UK Ltd acquiring a majority shareholding in Thomas Cook (India) Ltd for pound116 million.'Not only is the Indian economy racing but business infrastructure in India is catching up with this growth, with the depth of skills contained within the workforce as a whole continuing to attract foreign investment from around the globe,' Chande said.'The opportunities for UK companies are huge, but unless decision making is well-informed, India still holds many more M and amp;A pitfalls than traditional markets such as Europe and the US,' he added.

Be Indian, buy British is the new business mantra - Yahoo! India News

Blogged with the Flock Browser

Intresting Posts from Other Blogs or sites

Hi, here i will be posting interesting posts from other blogs... I know you don't want to miss them...