Japan Registry Services

DNS Monkey-in-the-middle Attack
Fujiwara, Kazunori <fujiwara@jprs.co.jp>
Japan Registry Services Co., LTD.
DNSSEC Summit Feb. 21, 2005

Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

Demonstration• Today, I will demonstrate DNS spoofing.
• This uses special network– SSID: dns• You don’t like this demonstration,
use APRICOT SSID: apricot

Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

Attacks to DNS• DoS to servers– Send many queries to DNS servers– It is mere disturbance.
– It’s easy, but attacker gets benefit?

• DNS data spoofing– Induce to another site
• Phishing: economical benefit• Alternative root

Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

RFC2833 Threat Analysis of the Domain Name System•

Packet Interception

Spoofed– Monkey-in-the-middle– Intercept DNS queries(1) on Shared packet
ethernet or Wireless LAN and answers
spoofed response before a correctresponse(8).
– Easiest and efficient -> We tried.

•ID Guessing and Query Prediction

Authoritative Server
Root servers(2)www.example.jp A？

(3)JP Servers know (JP NS+glue)

ISP Resolver
server(4)www.example.jp A？

JP DNS servers– injection at (3), (5),(7)•(5)example.jp server knows
example JP NS and glue

Name Chaining– cache poisoning••Hijacked DNS server
Measure:– Application side: SSH, SSL/TLS– TSIG– DNSSEC
Copyright © 2005 Japan Registry Services Co., LTD.

(6)www.example.jp A？
(1)www.example.jp A？
(7)

CrackedILL WILL(8)www.example.jp A
is 192.168.100.1

Spoofedpacketexample.jp(7)www.example.jp A is192.168.100.1

Japan Registry Services

Monkey-in-the-middle attack• packet intercept– tcpdump dst port domain– Shared ethernet– Wireless (using Shared WEP key)
• Hot spot everywhere– tap at the Router or Switch– Cut cables and tap• Parse query packet• Generate Fake DNS answer• Write to the Network Interface
Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

Attack tools• All three are similar• dnshijack– somewhere in the Internet• uso800d– It’s made by Yuji Sekiya, WIDE Project.
– for Linux• My attack tool (dnsattack.c)– To research and demonstrate for DNSSEC– Two days work, originally 400 lines C code
– It uses BPF and pcap
– It runs on *BSD and MacOS XCopyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

DNS attack experiment in WIDE• at WIDE Project Research camp
– about 200 testees– announce 15 minutes DNS attack experiments without starttime– Any DNS ‘A’ query is induced to a specific address.
– At the inducement destination, we prepared web server, SSH
server, ...

• Environment– Wireless LAN, 11A, 11B multiple channels, (WEP)– DNS attack tools on portable PC– Inducement destination PC– recording (tcpdump) PC– Sekiya’s uso800d, fujiwara’s attack tool
Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

DNS attack result••••Found 100 IP addresses from tcpdump
90% IP addresses were induced to fake web site.
evaluation by dig, 80% answers were induced.
Some people ignored ssh warning of host key change.

• Some failure to forge– Wireless channel problem (Only a part of channel was attacked.)– Wireless reachability (Between user station and forging station)– Already cached DNS data is faster than forging.
– This tool is not support IPv6 DNS resolving

Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

Experiment validity• No need to consider this attack in ethernet switchenvironment?
• We can attack using ARP Poisoning/ARP Spoofing– To Confuse Switch’s ARP table• On 802.11x environment,– No shared key, cannot intercept packets• At the shared network, we can attack all protocols
directly, some people says protecting only DNS isuseless.
• But, DNS forging raises efficient phishing.

Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

Demonstration• Use special network– SSID: dns• If you don’t like this demonstration, use
APRICOT SSID: apricot• Please refrain from important newcommunication from now.
• Now, I start the attack program.
• Let's see web.
• Most access will be induced to special site.
• How do you think ?
Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry Services

Restore from this demonstration• Change SSID to ‘apricot’• WindowsXP– ipconfig /flashdns– restart applications (Web browsers)• MacOS X– lookupd –flashcache• BSD– restart local caching server (If you use)
– restart applications
Copyright © 2005 Japan Registry Services Co., LTD.

Japan Registry ServicesQuestion• DNSSEC may solve this kind of attack.

Copyright © 2005 Japan Registry Services Co., LTD.