\nSo, it's out. Apparently, Halvar got pretty close and Matasano accidentally posted the whole thing on their blog — d'oh.\n
\n\nSo, as hiding it now is definitely too late, I guess the »no speculation rule« is off the table as well. Here are some random thoughts of mine:\n
\n\nThis is huge. It is pretty easy to exploit, so I wonder how stable DNS will be within the next few days (at work, I use a T-Mobile hotspot which apparently messes transparently with my DNS traffic, so dnscache refuses to work, thus I am vulnerable even though I could help it by running a local dnscache — bummer).\n
\n\nLutz Donnerhacke keeps saying on the Heise forums that this is not Dan's original exploit (which he claims to know, and I believe him), so I wonder whether this is something completely new or whether it's just a variant on Dan's exploit. On the »this is it« side is the testing of $random.toorrr.com, which closely matches the exploit scenario. Also, Dan has been looking at random subdomains of domains in the web context, which apparently with some providers don't return NXDOMAIN but a provider specific page (this has the \"nice\" implication that if it can be exploited, the cookies for $domain are in danger even though the website that is compromised is not made by the real owner of $domain). \n
\n\nI would guess that there are some more tricks to it, as Dan returns ::1 on AAAA queries with his (obviously custom) nameserver, so I doubt this is by accident but serves some kind of purpose. Also, all of the advisories mention the birthday paradox which has not come into play with this exploit (yet) - this is just iterative guessing, but there is no such thing as having multiple outstanding queries for the same RR or so. Furthermore, Thomas Ptacek set pretty high expectations on when he would be impressed, and apparently he was ...\n
\n\nThis exploit would be particularly easy/fast if you could generate the spoofed responses at the requesting client as well, anyone knows if this is remotely possible using Flash, Java, or some other browser-based client stuff?\n
\n\nWell, interesting times to be a security researcher ...\n
\n" signed: 0 summary: " So, it's out [1]. Apparently, Halvar [2] got pretty …" tags: - english: 1 - security: 1 text: "\n So, it's out [1]. Apparently, Halvar [2] got pretty close and Matasano\n accidentally posted the whole thing on their blog — d'oh.\n\n So, as hiding it now is definitely too late, I guess the »no specu-\n lation rule« is off the table as well. Here are some random\n thoughts of mine:\n\n This is huge. It is pretty easy to exploit, so I wonder how stable DNS\n will be within the next few days (at work, I use a T-Mobile hotspot\n which apparently messes transparently with my DNS traffic, so dnscache\n refuses to work, thus I am vulnerable even though I could help it by\n running a local dnscache — bummer).\n\n Lutz Donnerhacke keeps saying on the Heise forums that this is not\n Dan's original exploit (which he claims to know, and I believe him), so\n I wonder whether this is something completely new or whether it's just\n a variant on Dan's exploit. On the »this is it« side is the testing of\n $random.toorrr.com, which closely matches the exploit scenario. Also,\n Dan has been looking at random subdomains of domains in the web contex-\n t, which apparently with some providers don't return NXDOMAIN but a\n provider specific page (this has the \"nice\" implication that if it can\n be exploited, the cookies for $domain are in danger even though the\n website that is compromised is not made by the real owner of $domain).\n\n I would guess that there are some more tricks to it, as Dan returns ::1\n on AAAA queries with his (obviously custom) nameserver, so I doubt this\n is by accident but serves some kind of purpose. Also, all of the advi-\n sories mention the birthday paradox which has not come into play with\n this exploit (yet) - this is just iterative guessing, but there is no\n such thing as having multiple outstanding queries for the same RR or\n so. Furthermore, Thomas Ptacek set pretty high expectations on when he\n would be impressed, and apparently he was ...\n\n This exploit would be particularly easy/fast if you could generate the\n spoofed responses at the requesting client as well, anyone knows if\n this is remotely possible using Flash, Java, or some other\n browser-based client stuff?\n\n Well, interesting times to be a security researcher ...\n\n-- \n [1] http://beezari.livejournal.com/141796.html\n [2] http://addxorrol.blogspot.com/2008/07/on-dans-request-for-no-\n speculation.html\n" title: The(?) DNS Bug type: html uri: http://www.shiftordie.de/articles/The%20DNS%20Bug xhtml: "So, it's out. Apparently, Halvar got pretty close and Matasano accidentally posted the whole thing on their blog — d'oh.
So, as hiding it now is definitely too late, I guess the »no speculation rule« is off the table as well. Here are some random thoughts of mine:
This is huge. It is pretty easy to exploit, so I wonder how stable DNS will be within the next few days (at work, I use a T-Mobile hotspot which apparently messes transparently with my DNS traffic, so dnscache refuses to work, thus I am vulnerable even though I could help it by running a local dnscache — bummer).
Lutz Donnerhacke keeps saying on the Heise forums that this is not Dan's original exploit (which he claims to know, and I believe him), so I wonder whether this is something completely new or whether it's just a variant on Dan's exploit. On the »this is it« side is the testing of $random.toorrr.com, which closely matches the exploit scenario. Also, Dan has been looking at random subdomains of domains in the web context, which apparently with some providers don't return NXDOMAIN but a provider specific page (this has the "nice" implication that if it can be exploited, the cookies for $domain are in danger even though the website that is compromised is not made by the real owner of $domain).
I would guess that there are some more tricks to it, as Dan returns ::1 on AAAA queries with his (obviously custom) nameserver, so I doubt this is by accident but serves some kind of purpose. Also, all of the advisories mention the birthday paradox which has not come into play with this exploit (yet) - this is just iterative guessing, but there is no such thing as having multiple outstanding queries for the same RR or so. Furthermore, Thomas Ptacek set pretty high expectations on when he would be impressed, and apparently he was ...
This exploit would be particularly easy/fast if you could generate the spoofed responses at the requesting client as well, anyone knows if this is remotely possible using Flash, Java, or some other browser-based client stuff?
Well, interesting times to be a security researcher ...
"