Home page logo
/

bugtraq logo Bugtraq mailing list archives

RE: International DNS compromise?
From: "Johan Nilsson" <johan.nilsson () axis com>
Date: Fri, 6 Aug 2004 07:58:38 +0200

Hi,

Did a little test, from a small isp in Sweden

- First, look up all records for www.rfa.com
# dig www.rfa.com any 

; <<>> DiG 9.2.1 <<>> www.rfa.com any
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43829
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0

;; QUESTION SECTION:
;www.rfa.com.                   IN      ANY

;; ANSWER SECTION:
www.rfa.com.            3600    IN      A       64.74.40.4

;; AUTHORITY SECTION:
rfa.com.                172800  IN      NS      ns1.rfasource.com.
rfa.com.                172800  IN      NS      ns2.rfanyc.com.
rfa.com.                172800  IN      NS      ns3.rfanyc.com.

;; Query time: 299 msec
;; SERVER: 195.67.199.39#53(195.67.199.39)
;; WHEN: Fri Aug  6 07:51:13 2004
;; MSG SIZE  rcvd: 116 

- Second, lookup of www.rfa.com on one of the authorative servers
# dig @ns1.rfasource.com www.rfa.com any

; <<>> DiG 9.2.1 <<>> @ns1.rfasource.com www.rfa.com any
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15314
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.rfa.com.                   IN      ANY

;; ANSWER SECTION:
www.rfa.com.            3600    IN      A       64.74.40.4

;; Query time: 104 msec
;; SERVER: 66.151.213.9#53(ns1.rfasource.com)
;; WHEN: Fri Aug  6 07:53:55 2004
;; MSG SIZE  rcvd: 45

To me, this means that all DNS-replies that would give you an other ip
for www.rfa.com, would be either compromised or manipulated.

There is, of course, the stray possibility of rfa.com having "global
loadbalancing" for it's website, meaning that the dns-reply will differ
depending on the part of the world you're in, like IBM did a few years
back, when hosting the site for the olympic games.

Brgds
Johan

-----Original Message-----
From: travis.alexander () lacamas org 
[mailto:travis.alexander () lacamas org] 
Sent: den 5 augusti 2004 19:37
To: zhenshi99 () yahoo com; bugtraq () securityfocus com
Subject: RE: International DNS compromise? 

I got six different results, meaning six different server IP's.

1. 64.33.99.47
2. 207.12.88.98
3. 208.56.31.43
4. 216.221.188.182
5. 65.160.219.113
6. 65.104.202.252

All US owned IP addresses. Yes this is very interesting. So 
what does this mean, or potentially mean...?

Travis.

-----Original Message-----
From: Zhen Shi [mailto:zhenshi99 () yahoo com]
Sent: Wednesday, August 04, 2004 10:11 PM
To: bugtraq () securityfocus com
Subject: International DNS compromise? 


Dear all,
  Recently I noticed something fishy in the DNS system 
between US and China. 
  First, any IPs, dead or live, in China will respond to your 
DNS query for some domains. For example (screen shot with 
some clean-up and comments): 

C:\>nslookup

server 210.77.0.0     <=== pick a random IP     in
China
Default Server:  [210.77.0.0]
Address:  210.77.0.0

www.rfa.org
Server:  [210.77.0.0]
Address:  210.77.0.0

Non-authoritative answer:
Name:    www.rfa.org
Address:  203.105.1.21  <=== you got response!!!!

  Second, every time the response is different: 

www.rfa.org
Server:  [210.77.0.0]
Address:  210.77.0.0

Non-authoritative answer:
Name:    www.rfa.org
Address:  64.66.163.251

www.rfa.org

Non-authoritative answer:
Name:    www.rfa.org
Address:  64.33.99.47

www.rfa.org

Non-authoritative answer:
Name:    www.rfa.org
Address:  128.121.126.139

 Third, you can even get response from non-exist host
names: 

nosuchhost.rfa.org
Server:  [210.77.0.0]
Address:  210.77.0.0

Non-authoritative answer:
Name:    nosuchhost.rfa.org
Address:  65.104.202.252

nosuchhost.rfa.org

Non-authoritative answer:
Name:    nosuchhost.rfa.org
Address:  64.33.99.47

  What on earth is really going on here? It seems the DNS 
system is messed up between US and China, and its integrity 
is compromised. People can be unknowingly redirected to any where ... 

--Zhen



              
__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo 



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault