Feeds

Caching bugs exposed in second biggest DNS server

Birthday Paradox stumps djbdns

Intelligent flash storage arrays

For years, cryptographer Daniel J. Bernstein has touted his djbdns as so secure he promised a $1,000 bounty to anyone who can poke holes in the domain name resolution software.

Now it could be time to pay up, as researchers said they've uncovered several vulnerabilities in the package that could lead end users to fraudulent addresses under the control of attackers.

djbdns is believed to be the second most popular DNS program, behind Bind. The bugs show that even the most secure DNS packages are susceptible to attacks that could visit chaos on those who use them.

One of the bugs, disclosed last week by researcher Kevin Day, exploits a known vulnerability in the DNS system that allows attackers to poison domain name system caches by flooding a server with multiple requests for the same address.

It was discovered in 2002 and applies a much older probability theory known as the Birthday Paradox. This holds that for a group of 23 randomly chosen people, there is a better than 50-per-cent probability that some pair will have been born on the same day and a better than 99-per-cent chance if the group is expanded to 57 people.

Attackers can exploit the condition by sending as few as 200 simultaneous domain-name requests to a server running djbdns. Under certain conditions, the DNS software will then return fraudulent IP addresses for that particular website address, according to this paper (PDF), which describes the attack in detail. Bind and other DNS programs added protection against the exploit years ago, so it was surprising when the vulnerability was only recently detected in Bernstein's package.

"We've known for seven years that you have to prevent simultaneous queries for the same name," DNS-security expert Dan Kaminsky told The Register. "They [the people responsible for djbdns] didn't and so they lost a fair amount of their security from that."

Neither Bernstein nor Day were available to comment for this story.

A second vulnerability in djbdns was disclosed on Thursday that could also be used to trick servers into returning spoofed addresses for popular websites. Discovered by Matthew Dempsky, a software engineer at Mochi Media, it works by manipulating a feature that shortens long addresses by omitting repeated domains in certain cases.

The exploit works only when users are running djbdns companion packages known as axfrdns and tinydns, which Dempsky said is fairly rare. Nonetheless, those who use such configurations to serve authoritative DNS content should patch immediately, Dempsky said. (More details are available here.)

To be sure, these bugs are nothing like last year's DNS cache poisoning vulnerability that threatened trust as we know it on the internet. That bug, and similar ones uncovered over the years by researchers such as Amit Klein, were so wide spread that they had the potential to afflict much bigger numbers and there were fewer mitigating circumstances.

At time of writing, it was unclear if the discoveries would qualify for the $1,000 bounty Bernstein has promised to pay.

"I think it does," Dempsky said of the vulnerability he disclosed. "I emailed him [Bernstein] earlier this week when I first discovered the bug to ask him about it. He replied that he would evaluate it and get back to me, but probably not until next week." ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.