|Main Archive Page > Month Archives > full-disclosure-uk archives|
On 5/30/07, Steven Adair <email@example.com> wrote:
> We are also at risk from rogue developers, people that have
> hacked/poisoned your trusted DNS provider, those that have modified your
> /etc/hosts, /etc/resolv.conf, windows\system32\drivers\etc\hosts (and/or
> related files), people that have hacked the update server and put there
> own malicious version there, and the unlocked workstation attack from an
> attacker with a USB flash drive with a malicious update that might sit
> down at your workstation and -pwn- you.
Or, more simply, from a brute-force poisoning attack that doesn't involve compromising the trusted DNS provider at all. It's been known for *at least as long as I've been in this business* that DNS is *not* secure, even when both the DNS server and the requesting client are not compromised. There's no significant authentication of the DNS server's reply, so DNS responses can be trivially spoofed by an attacker who knows a window of time wherein you might request the address of a particular host.
An example of such a condition: scheduled automatic updates. That just happens to be exactly what is described here. You do the math.
This really should have been articulated in the original advisory, IMO. When applications depend on DNS for trust decisions, virtually *every* internet connection is untrusted.