Feeds

Caching bugs exposed in second biggest DNS server

Birthday Paradox stumps djbdns

The Essential Guide to IT Transformation

For years, cryptographer Daniel J. Bernstein has touted his djbdns as so secure he promised a $1,000 bounty to anyone who can poke holes in the domain name resolution software.

Now it could be time to pay up, as researchers said they've uncovered several vulnerabilities in the package that could lead end users to fraudulent addresses under the control of attackers.

djbdns is believed to be the second most popular DNS program, behind Bind. The bugs show that even the most secure DNS packages are susceptible to attacks that could visit chaos on those who use them.

One of the bugs, disclosed last week by researcher Kevin Day, exploits a known vulnerability in the DNS system that allows attackers to poison domain name system caches by flooding a server with multiple requests for the same address.

It was discovered in 2002 and applies a much older probability theory known as the Birthday Paradox. This holds that for a group of 23 randomly chosen people, there is a better than 50-per-cent probability that some pair will have been born on the same day and a better than 99-per-cent chance if the group is expanded to 57 people.

Attackers can exploit the condition by sending as few as 200 simultaneous domain-name requests to a server running djbdns. Under certain conditions, the DNS software will then return fraudulent IP addresses for that particular website address, according to this paper (PDF), which describes the attack in detail. Bind and other DNS programs added protection against the exploit years ago, so it was surprising when the vulnerability was only recently detected in Bernstein's package.

"We've known for seven years that you have to prevent simultaneous queries for the same name," DNS-security expert Dan Kaminsky told The Register. "They [the people responsible for djbdns] didn't and so they lost a fair amount of their security from that."

Neither Bernstein nor Day were available to comment for this story.

A second vulnerability in djbdns was disclosed on Thursday that could also be used to trick servers into returning spoofed addresses for popular websites. Discovered by Matthew Dempsky, a software engineer at Mochi Media, it works by manipulating a feature that shortens long addresses by omitting repeated domains in certain cases.

The exploit works only when users are running djbdns companion packages known as axfrdns and tinydns, which Dempsky said is fairly rare. Nonetheless, those who use such configurations to serve authoritative DNS content should patch immediately, Dempsky said. (More details are available here.)

To be sure, these bugs are nothing like last year's DNS cache poisoning vulnerability that threatened trust as we know it on the internet. That bug, and similar ones uncovered over the years by researchers such as Amit Klein, were so wide spread that they had the potential to afflict much bigger numbers and there were fewer mitigating circumstances.

At time of writing, it was unclear if the discoveries would qualify for the $1,000 bounty Bernstein has promised to pay.

"I think it does," Dempsky said of the vulnerability he disclosed. "I emailed him [Bernstein] earlier this week when I first discovered the bug to ask him about it. He replied that he would evaluate it and get back to me, but probably not until next week." ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Tor attack nodes RIPPED MASKS off users for 6 MONTHS
Traffic confirmation attack bared users' privates - but to whom?
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.