1 In 10 DNS Servers Vulnerable To Cache Poisoning - Roughly 1.3 million DNS servers still unpatched

1 In 10 DNS Servers Vulnerable To Cache Poisoning
Roughly 1.3 million DNS servers still unpatched
05:00PM Monday Nov 10 2008 by Karl Bode
tags: business · security · networking

Roughly ten percent of the Internet's DNS servers are still vulnerable to a cache poisoning attack that was revealed months ago, according to a worldwide survey of public-facing Internet nameservers. "We estimate there's 11.9 million nameservers out there, and over 40% allow open recursion, so they accept queries from anyone," DNS expert Cricket Liu tells Computer World. "Of those, a quarter are not patched," he says. "So there's 1.3 million nameservers that are trivially vulnerable."

Ask DSLReports.com: What Is NebuAD?

Swiss Bank, CA Court Censor Whistleblower Website

ISP Error Opens Security Holes in Web

Multiple Vendors Tackle DNS Design Flaw

Monday Evening Links

Wednesday Evening Links

Friday Evening Links

ISPs Fear Monster 40Gbps DDoS Attacks

Forums » 1 In 10 DNS Servers Vulnerable To Cache Poisoning


	view: topics flat text	Post a:

ctceo Premium join:2001-04-26 South Bend, IN clubs:	Dead Link The link »www.doxpara.com/?p=1176 referred to in the old thread does not work. The one at »entropy.dns-oarc.net/test/ , however does.
	permalink · 2008-11-10 17:09:32 ·

baineschile join:2008-05-10 Sterling Heights, MI	OpeNDNS The only way to go.
	permalink · 2008-11-10 17:16:51 ·

NetFixer
From my cold dead hands
Premium
join:2004-06-24
Murfreesboro, TN

·AT&T Southeast

·Vonage

·Cingular Wireless

·AT&T CallVantage

·Comcast

edit:
November 10th, @06:00PM

Re: OpeNDNS

said by baineschile

:

The only way to go.

OpenDNS is certainly ONE solution, but it is definitely NOT the ONLY solution.

In fact, the DNS servers used by your ISP (Comcast) are also immune to the Kaminsky DNS vulnerability referred to in the article.

said by Dan Kaminsky :

I do think Nominum, and ComCast by extension, need some credit for working to develop more intensive protections against this attack...

It's not every day that Comcast and I are on the same side of the fence (ahem, net neutrality). This is however a much graver threat, and frankly more ISP's need to follow Comcast's lead here (now there are words I never thought I'd write!).

--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
Test your firewall.
Smell the flowers.

permalink · 2008-11-10 17:42:11 · Print ·

rob27 Premium join:2008-07-16 Mary Esther, FL	Re: OpeNDNS there's also 4.2.2.2 4.2.2.3 which are level 3 hosted DNS sites.
	permalink · 2008-11-10 17:52:50 ·

jester121 join:2003-08-09 Lake Zurich, IL ·ViaTalk	Re: OpeNDNS Level 3 mentioned in passing (about the time the details on the cache poisoning proof of concept came out) that they would eventually be shutting off public access to their beloved and ubiquitous 4.2.2.x DNS servers. That will be a very interesting day in the IT field, when we learn who's sloppy and who's not.
	permalink · 2008-11-10 19:35:53 ·

kieranmullen
Premium
join:2005-12-12
Portland, OR

·Verizon FIOS

·Vonage

·magicjack.com

·ViaTalk

·VoicePulse

·BroadVoice

Re: OpeNDNS

Is it considered sloppy to put clients on OpenDNS rather than their ISP's dns? I mean OpenDNS has so many other nice options as far as filtering goes as well and the ads are not a big turnoff.

said by jester121

:

Level 3 mentioned in passing (about the time the details on the cache poisoning proof of concept came out) that they would eventually be shutting off public access to their beloved and ubiquitous 4.2.2.x DNS servers.

That will be a very interesting day in the IT field, when we learn who's sloppy and who's not.

permalink · 2008-11-10 20:11:39 · Print ·

jester121 join:2003-08-09 Lake Zurich, IL ·ViaTalk	Re: OpeNDNS No clue about that, we run our own internal DNS. The thing is that Level 3's 4.2.2.x servers aren't "officially" open to the public like OpenDNS ones are, they've just been around forever and easy to remember. I use them occasionally for troubleshooting or if I need to go to an ISP website to fix someone's computer...
	permalink · 2008-11-10 20:46:38 ·

kieranmullen
Premium
join:2005-12-12
Portland, OR

·Verizon FIOS

·Vonage

·magicjack.com

·ViaTalk

·VoicePulse

·BroadVoice

edit:
November 10th, @09:01PM

Re: OpeNDNS

said by jester121

:

No clue about that, we run our own internal DNS. The thing is that Level 3's 4.2.2.x servers aren't "officially" open to the public like OpenDNS ones are, they've just been around forever and easy to remember. I use them occasionally for troubleshooting or if I need to go to an ISP website to fix someone's computer...

They are the servers that are used for Verizon Fios Setup too! I wonder if they have some sort of agreement with them. Simply typing DNS in the help section of Verizon.net did not yield any results except for a dial up dns server.

permalink · 2008-11-10 20:59:54 · Print ·

NetFixer
From my cold dead hands
Premium
join:2004-06-24
Murfreesboro, TN

·AT&T Southeast

·Vonage

·Cingular Wireless

·AT&T CallVantage

·Comcast

edit:
November 10th, @10:39PM

Re: OpeNDNS

said by kieranmullen

:

They are the servers that are used for Verizon Fios Setup too! I wonder if they have some sort of agreement with them.

Ask and ye shall receive

nslookup 4.2.2.1
Server:  dcs-gw1.dcs-net
Address:  192.168.10.1
 
Name:    vnsc-pri.sys.gtei.net
Address:  4.2.2.1
 
nslookup 4.2.2.2
Server:  dcs-gw1.dcs-net
Address:  192.168.10.1
 
Name:    vnsc-bak.sys.gtei.net
Address:  4.2.2.2
 
nslookup 4.2.2.3
Server:  dcs-gw1.dcs-net
Address:  192.168.10.1
 
Name:    vnsc-lc.sys.gtei.net
Address:  4.2.2.3
 
-----------------------------------------------------------------------
 
whois gtei.net
 
Registrant:
        Verizon Trademark Services LLC
        Verizon Trademark Services LLC
        1320 North Court House Road
         Arlington VA 22201
        US
        domainlegalcontact@verizon.com +1.7033513164 Fax: +1.7033513669
    Domain Name: gtei.net
        Registrar Name: Markmonitor.com
        Registrar Whois: whois.markmonitor.com
        Registrar Homepage: http://www.markmonitor.com
    Administrative Contact:
        Domain Administrator
        Verizon Trademark Services LLC
        1320 North Court House Road
         Arlington VA 22201
        US
        domainlegalcontact@verizon.com +1.7033513164 Fax: +1.7033513669
    Technical Contact, Zone Contact:
        Domain Technician
        Verizon
        1320 North Court House Road
         Arlington VA 22201
        US
        sysmgr@verizon.com +1.7033513164 Fax: +1.7033513669
    Created on..............: 1997-12-10.
    Expires on..............: 2010-12-08.
    Record last updated on..: 2008-11-06.
    Domain servers in listed order:
    dnsauth3.sys.gtei.net
    dnsauth2.sys.gtei.net
    dnsauth1.sys.gtei.net

The reason that the 4.2.2.x DNS servers are frequently referred to as Level3 servers is that the IP NetRange/CIDR is owned by Level3.

--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
Test your firewall.
Smell the flowers.

permalink · 2008-11-10 22:34:26 · Print ·

kieranmullen
Premium
join:2005-12-12
Portland, OR

·Verizon FIOS

·Vonage

·magicjack.com

·ViaTalk

·VoicePulse

·BroadVoice

edit:
November 10th, @10:59PM

Re: OpeNDNS

ask... well I suppose I could have looked it up as well.

Why would level3 have a hold on IP blocks from verizon? You would think that verizon would have many of its own blocks registered.

»www.isp-planet.com/news/2002/lvl···129.html

Level3 bought genuity.com which was the networking GTE I believe. Verizon bought GTE.

Nevermind its a mess that does not benefit me knowing in anyway. I will just assume for the foreseeable future that the Level 3 servers will work with Verizon FIOS

permalink · 2008-11-10 22:52:57 · Print ·

NetFixer
From my cold dead hands
Premium
join:2004-06-24
Murfreesboro, TN

·AT&T Southeast

·Vonage

·Cingular Wireless

·AT&T CallVantage

·Comcast

edit:
November 10th, @10:58PM

Re: OpeNDNS

said by kieranmullen

:

Why would level3 have a hold on IP blocks from verizon? You would think that verizon would have many of its own blocks registered.

Why would Microsoft need to use Akamai Technologies servers and IP adresses? The simple answer is that corporations sub contract and sub lease services and properties from other corporations all the time.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
Test your firewall.
Smell the flowers.

permalink · 2008-11-10 22:57:55 · Print ·

kieranmullen
Premium
join:2005-12-12
Portland, OR

·Verizon FIOS

·Vonage

·magicjack.com

·ViaTalk

·VoicePulse

·BroadVoice

Re: OpeNDNS

I believe the above lends some information on the intermixing...

said by NetFixer

said by kieranmullen

:

Why would level3 have a hold on IP blocks from verizon? You would think that verizon would have many of its own blocks registered.

permalink · 2008-11-10 22:59:51 · Print ·

NetFixer From my cold dead hands Premium join:2004-06-24 Murfreesboro, TN ·AT&T Southeast ·Vonage ·Cingular Wireless ·AT&T CallVantage ·Comcast	Re: OpeNDNS said by kieranmullen : I believe the above lends some information on the intermixing... I believe the term for this type of perpetual post buyout/merger usage is grandfathering. -- History does not long entrust the care of freedom to the weak or the timid. -- Dwight D. Eisenhower Test your firewall. Smell the flowers.
	permalink · 2008-11-10 23:09:20 · Print ·

kontos
xyzzy

join:2001-10-04
West Henrietta, NY

said by kieranmullen

I suspect that that is a result of sloppy reverse DNS management on Level3's part.
Verizon (gtei.net) doesn't seep to agree that those hostnames are theirs:

and the servers appear to indicate that they are managed by Level3:

permalink · 2008-11-11 10:18:30 · Print ·

Raphion join:2000-10-14 Samsara	I have 4.2.2.4-5 as my DNS, but when I go to »entropy.dns-oarc.net/test/ it tells me my server names are: 1. 209.244.5.159 (ics2.Atlanta1.Level3.net) 2. 209.244.7.132 (unknown.Level3.net) No gtei there. As I understand it, those 4.2.2.x addresses aren't actually server addresses, but rather, requests to those addresses are routed to the nearest available Level3.net DNS servers.
	permalink · 2008-11-11 17:19:29 ·

backfeed is giving feedback join:2002-12-16 Peru, IN ·Comcast Digital Vo.. ·Comcast Formerly ..	I am using Open DNS now on my networks, I have used Level 3's in a pinch, but I always thought that it was wrong to use them as a standard. They do work good, but I am really surprised that they have left them open to the public for so long... -- There is 10 types of people. Those whom can read Binary and those who cannot.
	permalink · 2008-11-10 20:45:56 ·

NetAdmin

join:2008-05-22

said by jester121

:

That will be a very interesting day in the IT field, when we learn who's sloppy and who's not.

Or who can remember their ISPs DNS servers. 4.2.2.2 was such a great server because it was so easy to use during an initial setup when you didn't have easy access to your ISPs DNS addresses or just plain forgot the DNS server address.
--
---
Drilling for more oil is akin to giving a methhead the keys to the meth lab.

permalink · 2008-11-10 23:34:57 · Print ·

NetFixer
From my cold dead hands
Premium
join:2004-06-24
Murfreesboro, TN

·AT&T Southeast

·Vonage

·Cingular Wireless

·AT&T CallVantage

·Comcast

edit:
November 10th, @11:47PM

Re: OpeNDNS

said by NetAdmin

said by jester121

:

That will be a very interesting day in the IT field, when we learn who's sloppy and who's not.

I think the "interesting day" and "sloppy" references are about the unknown thousands of PCs currently using the 4.2.2.x DNS servers because some tech did a quick fix 5 years ago and now nobody even remembers that it had been done.

The downtime and ISP and IT department headaches that will result on the day those DNS servers become restricted to authorized users could rival the problems caused by Blaster and Welchia.
--
History does not long entrust the care of freedom to the weak or the timid.
-- Dwight D. Eisenhower
Test your firewall.
Smell the flowers.

permalink · 2008-11-10 23:46:27 · Print ·

jlivingood Premium,VIP join:2007-10-28 Philadelphia, PA	said by NetFixer : said by baineschile : The only way to go. OpenDNS is certainly ONE solution, but it is definitely NOT the ONLY solution. In fact, the DNS servers used by your ISP (Comcast) are also immune to the Kaminsky DNS vulnerability referred to in the article. That is correct. Jason -- JL Comcast
	permalink · 2008-11-10 17:56:09 · Print ·

baineschile join:2008-05-10 Sterling Heights, MI	Obviously there are plenty of alternatives, most which are safe. I just saw such an increase in page loading and java when i switched to OPEN DNS
	permalink · 2008-11-10 18:05:27 ·

AnonNane @trit.net	1 In 10 DNS Servers Vulnerable... I wonder if 1 in 10 Internet users know what this means?
	permalink · 2008-11-10 18:22:02 ·

knightmb Everybody Lies join:2003-12-01 Franklin, TN ·Comcast ·Vonage ·Speakeasy	Re: 1 In 10 DNS Servers Vulnerable... said by AnonNane : I wonder if 1 in 10 Internet users know what this means? Good point. -- Fight NebuAD and the like: Click Here to pollute their data
	permalink · 2008-11-10 22:02:38 ·

DOStradamus
MVM
join:2003-11-04
Santa Rosa, CA

Drinking Milk Leads to Heroin Addiction, Too!

I stronly suspect that the over-simplified definition of "vulnerable" is leading to inflated figures to one degree or another.

I run my own DNS, AUTH for the handful of names I own, and purposely run it open/recursive. Why? I often need DNS access for troubleshooting purposes, for situations where the DNS servers a client is supposed to use can't be foundor determimned, and a couple others.

My DNS isn't vulnerable, however. Why? Along with DNS, I also run email, FTP,SSH,HTTP.and a few other services. I monitor them all for single-dight thresholds of failed logins, "404"s, and a dozen or so DNS lookups, that originate from the same /24 network. When "hit", a text message is sent to my cellphone alerting me about the door that's about to be slammed shut.

I'd love to see someone grab the Tarpit code from Iptables, and package it into a command where I can send an abusive connection to "Pico and Sepulveda"...

-NK

permalink · 2008-11-10 22:22:09 · Print ·

kontos
xyzzy

join:2001-10-04
West Henrietta, NY

edit:
November 11th, @11:05AM

Re: Drinking Milk Leads to Heroin Addiction, Too!

said by DOStradamus

:

My DNS isn't vulnerable, however. Why? Along with DNS, I also run email, FTP,SSH,HTTP.and a few other services. I monitor them all for single-dight thresholds of failed logins, "404"s, and a dozen or so DNS lookups, that originate from the same /24 network. When "hit", a text message is sent to my cellphone alerting me about the door that's about to be slammed shut.

It is not the queries that will poison your cache, it's the answers. A well designed attack will get a trusted user to generate the initial queries (maybe via a webpage with a bunch of IMG SRC="" tags).

permalink · 2008-11-11 10:45:33 · Print ·

your comment..

Forums » 1 In 10 DNS Servers Vulnerable To Cache Poisoning


Friday, 09-Jan 05:50:29	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 9 years online! © 1999-2009 dslreports.com.

Dead Link

OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

Re: OpeNDNS

1 In 10 DNS Servers Vulnerable...

Re: 1 In 10 DNS Servers Vulnerable...

Drinking Milk Leads to Heroin Addiction, Too!

Re: Drinking Milk Leads to Heroin Addiction, Too!