El Noguer

A principis d’aquest mes es va presentar la solució a uns greus problemes de seguretat que afectaven a molts servidors DNS de diversos fabricants i que afectava a tot el món.
 
El servei de DNS és un servei d’Internet que tradueix les adreces al
seu corresponent número de servidor. Per exemple el nom noguer.bloc.cat
li correspon el número de servidor 217.149.5.228. El DNS és com el
llibre de pàgines blanques de telèfons fixes. El servei DNS és vital a
Internet perquè l’usuari es refia completament que quan escriu l’adreça
del seu banc, el qui està respon és el banc i no ningú altre.

El problema de seguretat el va trobar el març Dan Kaminsky d’IOActive. Ràpidament Paul  Vixie de l’Internet Systems Consortium (ISC)
va escalar el problema.  La solució del problema afectaven a Microsoft,
Sun i Cisco. Totes elles han treballat coordinadament per a presentar
una solució alhora.

Aquest juliol Dan Kaminsky ha penjat al seu web www.doxpara.com un servei per a comprovar si el DNS que feu servir és vulnerable encara o no.

Podeu llegir més detalls del problema de seguretat a US-CERT:

• Insufficient transaction ID space
  The DNS protocol specification includes a transaction ID field of 16
  bits. If the specification is correctly implemented and the transaction
  ID is randomly selected with a strong random number generator, an
  attacker will require, on average, 32,768 attempts to successfully
  predict the ID. Some flawed implementations may use a smaller number of
  bits for this transaction ID, meaning that fewer attempts will be
  needed. Furthermore, there are known errors with the randomness of
  transaction IDs that are generated by a number of implementations. Amit
  Klein researched several affected implementations in 2007. These
  vulnerabilities are described in the following vulnerability notes:
  • VU#484649 – Microsoft Windows DNS Server vulnerable to cache poisoning
  • VU#252735 – ISC BIND generates cryptographically weak DNS query IDs
  • VU#927905 – BIND version 8 generates cryptographically weak DNS query identifiers
• Multiple outstanding requests
  Some implementations
  of DNS services contain a vulnerability in which multiple identical
  queries for the same resource record (RR) will generate multiple
  outstanding queries for that RR. This condition leads to the
  feasibility of a ‘birthday attack,’ which significantly raises an
  attacker’s chance of success. This problem was previously described in VU#457875. A number of vendors and implementations have already added mitigations to address this issue.
• Fixed source port for generating queries
  Some current implementations allocate an arbitrary port at startup
  (sometimes selected at random) and reuse this source port for all
  outgoing queries. In some implementations, the source port for outgoing
  queries is fixed at the traditional assigned DNS server port number,
  53/udp.

Tweet