poisoning_ipsj

Size: px

Start display at page:

Download "poisoning_ipsj"

ときはやしもと
5 years ago
Views:

1 DNS! /!

2 ! 2/15 qmail.jp JPRS! 2/28 JP JPRS! 3/1 JPRS JP ( )! 3/16 JPRS JP DNSSEC TXT ( )! 4/1 JPRS! 4/15 JPRS ( )! 4/15

3 DNS?

4 2008 Blackhat Kaminsky! Additional Section B.Müller! "IMPROVED DNS SPOOFING USING NODE RE-DELEGATION", Blackhat Kaminsky! Non-existent subdomains can't already be cached, so they're easy to inject.

5 ( ) (co.jp ) (nic.uk / dns.jp 7/24 ) NS (nic.uk -> uk)

6 1 NS ( ) : go.jp, aichi.jp, gouv.fr (NS+A)! ( )!

7 2 ( ) 1: dns.kr ( kr dns.kr ) ( ) NS+A

8 > dnsq a asfsd.dns.kr a.root-servers.net 1 asfsd.dns.kr: 278 bytes, records, response, noerror query: 1 asfsd.dns.kr authority: kr NS g.dns.kr authority: kr NS f.dns.kr authority: kr NS e.dns.kr authority: kr NS d.dns.kr authority: kr NS c.dns.kr authority: kr NS b.dns.kr! > dnsq a asfsd.dns.kr c.dns.kr 1 asfsd.dns.kr: 90 bytes, records, response, authoritative, nxdomain query: 1 asfsd.dns.kr authority: dns.kr SOA g.dns.kr domain-manager.nic.or.kr ! > dnsq ns dns.kr c.dns.kr 2 dns.kr: 272 bytes, records, response, authoritative, noerror query: 2 dns.kr answer: dns.kr NS d.dns.kr answer: dns.kr NS e.dns.kr answer: dns.kr NS g.dns.kr answer: dns.kr NS c.dns.kr answer: dns.kr NS b.dns.kr answer: dns.kr NS f.dns.kr

9 2 ( ) 2: ( internot.jp bar.internot.jp ) (NS+A)

10 bar.internot.jp NS! % dnsq ns bar.internot.jp ns.internot.jp answer: bar.internot.jp 3600 NS ns.bar.internot.jp additional: ns.bar.internot.jp 3600 A % dnsq a ns.internot.jp query: 1 authority: foo.bar.internot.jp 3600 NS ns.foo.bar.internot.jp additional: ns.foo.bar.internot.jp 3600 A % dnsq a ns.foo.bar.internot.jp answer: A authority: foo.bar.internot.jp 7200 NS ns.foo.bar.internot.jp additional: ns.foo.bar.internot.jp 7200 A

11 3 NS! dns.kr KR ( dns.jp ) gtld-servers.net NET, COM root-servers.net

13 NS ( )! ( co.jp )

14 CO.JP : $random.co.jp. IN A jp : NXDOMAIN jp : AA : 0 Answer Section : Authority Section : co.jp. IN NS ns.poison.nom.

15 KR : $random.dns.kr. IN A kr : NXDOMAIN kr : AA : 0 Answer Section : Authority Section : dns.kr. IN NS ns.poison.nom. ( [b-g].dns.kr kr )

17 RFC2181 Data from a primary zone file, other than glue data, Data from a zone transfer, other than glue, The authoritative data included in the answer section of an authoritative reply. Data from the authority section of an authoritative answer, Glue from a primary zone, or glue from a zone transfer, Data from the answer section of a non-authoritative answer, and nonauthoritative data from the answer section of authoritative answers, Additional information from an authoritative answer, Data from the authority section of a non-authoritative answer, Additional information from non-authoritative answers. NS NS

18 ! (RFC2181 / ) (RFC2181 / ) (NS )

19 JP : $random.jp. IN A jp : NXDOMAIN jp :! AA : 1 Answer Section : $random.jp IN A Authority Section : jp. IN NS ns.poison.nom.!

20 : $random. IN A. : NXDOMAIN. : AA : 1 Answer Section : $random. IN A Authority Section :. IN NS ns.poison.nom.

21 : $random. IN A. : NXDOMAIN. : AA : 1 Answer Section : $random. IN A Authority Section :. IN NS ns.poison.nom.

22 priming BIND, Unbound. NS! BIND. NS (?). NS

23 root-servers.net root-servers.net. net NS : $random.root-servers.net. IN A : NXDOMAIN : AA : 1 Answer Section: $random.root-servers.net IN A Authority Section: root-servers.net. IN NS ns.poison.nom.

24 ; Auth Authority NS [a-m].root-servers.net. ; Auth Authority root-servers.net NS ns.poison.nom. ( ) root-servers.net NS [a-m].root-servers.net. ; glue [a-m].root-servers.net A [a-m].root-servers.net authanswer ; authanswer [a-m].root-servers.net A

26 DNSSEC Authority Section NS TTL DoS! OPT-OUT? RFC5155 (Errata ) gouv.fr opt-out co.jp opt-out (TXT ) ( ) D.J.Bernstein 2009

27 Breaking DNSSEC D.J.Bernstein, 2009 Easiest, most powerful attack: Can ignore signatures. Suppose an attacker forges a DNS packet from.org, including exactly the same DNSSEC signatures but changing the NS+A records to point to the attacker s servers.

28 Breaking DNSSEC D.J.Bernstein, 2009 Fact: DNSSEC verification won t notice the change. The signatures say nothing about the NS +A records. The forgery will be accepted.

29 ( ) ( ) 0x20!!! EDNS0 TCP ( )

30 ? query? mix7a3pwf9v.jp query? example.jp, exbmple.jp, excmple.jp. query? ( jp ) response

31 NS!! NS ( ) TCP ( ) Lame delegation!

32 RFC2181 (?) NS NS? DNS ZONE Apex( ) A ( ) DNS

33 FreeBSD RELEASE 9.1 -STABLE VIMAGE ( jail vnet ) DUMMYNET ( ) VITOCHA ( ) BIND P2, Unbound , NSD3! TLD SLD (NSD) (NSD) (Metasploit + ) (BIND, Unbound)

34 (JPRS, JPCERT/CC, IPA ) ( ) -> JPRS CO.JP > -> ->

35 2008 Blackhat Kaminsky ( ) 2009 Blackhat Kaminsky ( ) 2009 Kaminsky 5 (Kaminsky 2 ) 6 (Kaminsky/Mueller) ( )

経緯

頂上は如何に攻略されたか ~ ルートゾーンキャッシュポイズニング ~ 2014.06.05 IEICE 中京大学工学部鈴木常彦 * QMAIL.JP 前野年紀経緯 2/15 co.jp への毒入れ前野氏 : *.co.jp をJPサーバに問い合わせたときに co.jp が委譲されているかのような返事をするとキャッシュにないことは