Full Disclosure: Re: New Vulnerability against Firefox/ Major Extensions

["Matthew Murphy" <mattmurphy () kc rr com>]

On 5/30/07, Steven Adair <steven () securityzone org> wrote:
> We are also at risk from rogue developers, people that have
> hacked/poisoned your trusted DNS provider, those that have modified your
> /etc/hosts, /etc/resolv.conf, windows\system32\drivers\etc\hosts (and/or
> related files), people that have hacked the update server and put there
> own malicious version there, and the unlocked workstation attack from an
> attacker with a USB flash drive with a malicious update that might sit
> down at your workstation and -pwn- you.
Or, more simply, from a brute-force poisoning attack that doesn't
involve compromising the trusted DNS provider at all.  It's been known
for *at least as long as I've been in this business* that DNS is *not*
secure, even when both the DNS server and the requesting client are
not compromised.  There's no significant authentication of the DNS
server's reply, so DNS responses can be trivially spoofed by an
attacker who knows a window of time wherein you might request the
address of a particular host.

An example of such a condition: scheduled automatic updates.  That
just happens to be exactly what is described here.  You do the math.

This really should have been articulated in the original advisory,
IMO.  When applications depend on DNS for trust decisions, virtually
*every* internet connection is untrusted.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/