3

Based on my current research, enabling the unsecure DNS updates is a requirement for enabling DHCP Linux clients from registering their names with a FQDN.

While this works fine for Windows machines joined into the domain, the same doesn't work for Linux clients without enabling these unsecure updates.

As far as I know a machine would not be able to takeover another reserved name which would be the only real concern that I now.

Obviously it would be the DDOS but considering that we are talking about intranet here, I doubt this could be a real risk.

Do you have it enable on your domain or not?

Did you ever had to disable it due to having some problems with it?

Improve this question

1 Answer 1

Reset to default
5

When you use secure dynamic updates only the domain members can update their entries. This is achieved by using kerberos to authentificate the client towards the DNS-Server. This authentification funcionality does not seem to be implemented in Linux DNS-Clients and this is why you need to enable unsecure dynamic updates.

Unsecure dynamic updates allow one to update its own DNS record without authentification. This is clearly a threat because DNS is a UDP based protocol and the source address can easily be spoofed on a LAN.

On the other hand this is a very bad documented functionality and there are no tools publicly available that could be used to migrate this attack.

I did never migrate this attack but there are some risks I can think of.

  • Duplicate Names in DNS Server - Will either result in DoS or prevent a correct functionality of resolving the hostname
  • WPAD redirection. If you name your host wpad and setup a webserver that provides a proxy configuration you can pass a proxy configuration to internet explorer and chrome users. This is part of the WPAD protocol. The worst thing is that you can force the internet explorer to expose the authentificated users password hash by asking for NTLM authentification. I know its unbelivable but this can also be achieved by NBNS and LLMNR Poisoning using the tool Responder.

// This really got my interest when I got time Im going to write a POC tool that uses this vulnerability.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .