untitled

Transcription

1 Kaminsky Attack ( ) DNS DAY Tsuyoshi TOYONO ([email protected]) ( )

2 ( ) DNS DNS (DNS Cache Poisoning ) ( ) Pharming IP Pharming

3 Cache Poisoning 0 ( (RR) Cache TTL) (1136 ) 50% 5 (271 ) (100%) Poisoning RTT 40ms 1 1 qps ( ) 100 pps ~ 1000 pps 1 port (1port ) ( ) Poisoning RTT 40ms 1 1 qps ( ) 100 pps ~ 1000 pps 1 port (1port ) (min)

4 ( ) Poisoning RTT 40ms qps (100 / ) 100 pps ~ 1000 pps 1 port (1port ) [ ] ~2 Poisoning ( 1 /16 ) (min) AT&T (us) 2008/7/29 metasploit blog CNC (cn) 2008/8/21 Websense blog Malware 7/on-dns-attacks-in-wild-andjournalistic.html ontent/alerts/3163.aspx

5 DNS DNS DNSSEC DNS Patch Patch DNS source port TXID(16bit) * port (16bit) = 32bit 1/ /43 Brute force Caching server Resolver(Client) resolver patch (Windows )

6 ( ) (Port randomize (1)) Poisoning Port randomize Brute Force RTT 40ms 1 1 qps ( ) 100 pps ~ 1000 pps 1 port 16bit (min) ( ) (Port randomize (2)) Poisoning 0 13 /sec 4 ~5 Patch 10 (*) (*) (min)

7 ( ) patch(port randomize) / DNS Server UDP socket 2 5 Port Patch Config port NAT port DMZ ACL Filtering daemon UDP high port DNS (BIND option avoid) ( ) Recursion(Cache ) / ISP Bot Open Recursion( Cache ) Filtering/ACL Ingress Filtering urpf Authoritative IP

8 ( ) (rate limiting) 1 1 Poisoning gtld, TTL, 1 (?) ( )Authoritative ( ) Lame delegation Authoritative TTL TTL

9 Monitoring (1/2) UDP port DoS Poisoning Authoritative? dns oarc Monitoring (2/2) Authoritative BIND: Vantio ISC SIE cache poisoning attempt detection tool oarc.net/node/141 NTT PF oarc.net/files/workshop 2008/toyono.pdf (UDP DNS Packet ) IF In/Out UDP In/Out

10 Monitoring ( ) (1 ) 3 xxx.cn (?) xxx.cn (DNS?) DNS Patch Poisoning Windows OS DNS SOHO Appliance box WWW MX, ENUM, ACL, Reputation, Load balancing, ID OpenID ( proxy ) Web redirect Web Pharming/Phishing, SPAM, Account Cracking

11 ... Deploy 0x20 dns ( ) DNS FoObAr.com foobar.com 2 TCP Fallback IPv6 Dual Query DNSCurve DNSSEC!? DNSSEC DNS ( )RFC? ICANN : root signed Chain SOHO/dsl Firewall Appliance box / /? / Zone? /sec?

12 DNS DNS DNSSEC,

13 ( ) P ( t) = P(t): P(s): 1 t ( 1 P ) 1 ( S ) = 1 1 t: Rr: (1 ) Rq: W: RTT N: Port: Query port ( port 1) ID: DNS ID (16bit = 65536) Rq Rr W N Port ID t Rq ( ) URI Security Alert JPRS ( ) dns vuln cache poisoning update.html column/009.pdf JPNIC ( ) 02.html JPCERT/CC ( ) NTTv6 ( ) pdf US CERT CVE bin/cvename.cgi?name=cve Dan Kaminsky Steve Friedl's Unixwiz.net kaminsky dns vuln.html OARC oarc.net/oarc/services/dnsentropy Dan Kaminsky s DNS Checker OARC oarc.net/node/131 oarc.net/oarc/workshop 2008/agenda CERT.at DNS patchanalysis aug18.pdf