Physicist hacks DNS patch
Emergency patch flawed
A BORED RUSSIAN physicist has successfully hacked an emergency patch designed to fix a recently discovered DNS vulnerability.
Evgeniy Polyakov reportedly used two desktop computers and a high-speed
network link to fool the patch into returning a spoofed
address in just 10 hours.
According to Polyakov, a typical attack server generates approximately 40,000-50,000 fake replies before hitting on the right one. Polyakov also noted that if the port is matched "the probability of successful poisoning is more than 60 per cent".
Alarmed insecurity experts warned the patch could be exploited to redirect Internet traffic and collect user passwords.
The hacker appears to state on a
Russian
Bog, "DJBDNS does not suffer from this attack. It does. Everyone does. With
some tweaks it can take longer than BIND, but overall problem is there." µ
LINQ
New
York Times
Comments
cracked not hacked
When I read the title I thought, "oh, good." Then I read the article and I realized you meant he cracked an already existing patch. He did not hack a fix.Surely those at th'Inq knows the difference for god's sake.
We all knew this
We all knew this was still flawed, just less flawed. As is stated in Dan's blog, it takes a lot more to exploit the flaw but it's still there. The only warning you get is that you would see a HUGE increase in DNS traffic.This lets you know that someone is attacking, but it does nothing to prevent the attack.
Our bored Russian did nothing but prove the obvious. This patch only buys time, nothing else.
GZ
Po210
Them Russian physicists know all about poisoning.Not Very Feasible
This attack is not very feasible in the real world. The critical nature of the original bug was that it minimized the need for a brute force attack. While being able to succeed in an attack on a local network over a GigE connection with full control over both servers is interesting, it's orders of magnitude harder to successfully perform this attack over the Internet, especially if you don't want the remote admin noticing. DNSSec is the long-term fix for this problem, but it may be rather far away.Bog?
"Russian BOG".. are they smelly Blogs with a touch of Vodka?