Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I am trying to exploit the Kaminsky bug for a school assignment. The specific version of the bug that I want to exploit is sending a forged packet with false information about www.domain.com so that all users attempting to access www.domain.com com will be directed elsewhere. My packet looks like so,

flag: 8580
Query: ???.domain.com
Answer: ???.domain.com A IN x.x.x.x
Authority RR: domain.com NS IN ns www.domain.com
Additional RR: www.domain.com A IN x.x.x.x

My problem is that my victim DNS server is cacheing the address www.domain.com as additional information but not using it when I query the server for www.domain.com. Instead it goes out and fetches the correct records. The DNS server is on my LAN on a VM. It is bind9, I believe 9.9. I have tried turning off dnssec, port randomization is off, my thought is that there has been enough time for bind to patch up the server good enough to avoid this particular exploit. Any thoughts or suggestions? Should I try an older version of bind? I started this project to learn more about DNS and I have learned a lot, but now that I've gotten to this point it is just frustrating. If you want to see anything from my setup I should be able to pull that up for you. Thanks in advance for any advice.

I guess a better way of asking this without saying "help me hack this thing" are what kinds of security measures have been put into place to patch the Kaminsky bug? Particularly on bind9, but in general is good too.

share|improve this question

1 Answer

up vote 7 down vote accepted

The "Kaminsky bug" (CVE-2008-1447) affects "BIND 8 and 9 before 9.5.0-P1, 9.4.2-P1, and 9.3.5-P1".

share|improve this answer
Yeah, switched to an older version of bind and it worked. I wonder what they did, or if the fix is simply a more elegant version of randomization/dnssec implementation. – Mrjaco12 Mar 21 '12 at 22:59
2  
@Mrjaco12 "In order to provide more resilience, BIND has been updated to use a range of random UDP source ports. (CVE-2008-1447) Note: This errata also updates SELinux policy on Red Hat Enterprise Linux 4 and 5 to allow BIND to use random UDP source ports." – Mark Beadles Mar 21 '12 at 23:03
This answer doesn't really answer the question. Modern versions of BIND turn on source port randomization by default, so the Kaminsky attack is not going to work against modern versions of BIND. But Mrjaco12 seems to be asking a different question: are there any other defenses or changes that would prevent exploitation of the Kaminsky attack, when source port randomization is manually disabled? For instance, did newer versions of BIND change their caching strategy for additional records? The behavior he's observing suggests to me the answer might be yes. I'm curious what they are. – D.W. Oct 5 '12 at 16:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.