Bugtraq mailing list archives
RE: International DNS compromise?
From: "Johan Nilsson" <johan.nilsson () axis com>
Date: Fri, 6 Aug 2004 07:58:38 +0200
Hi, Did a little test, from a small isp in Sweden - First, look up all records for www.rfa.com # dig www.rfa.com any ; <<>> DiG 9.2.1 <<>> www.rfa.com any ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43829 ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.rfa.com. IN ANY ;; ANSWER SECTION: www.rfa.com. 3600 IN A 64.74.40.4 ;; AUTHORITY SECTION: rfa.com. 172800 IN NS ns1.rfasource.com. rfa.com. 172800 IN NS ns2.rfanyc.com. rfa.com. 172800 IN NS ns3.rfanyc.com. ;; Query time: 299 msec ;; SERVER: 195.67.199.39#53(195.67.199.39) ;; WHEN: Fri Aug 6 07:51:13 2004 ;; MSG SIZE rcvd: 116 - Second, lookup of www.rfa.com on one of the authorative servers # dig @ns1.rfasource.com www.rfa.com any ; <<>> DiG 9.2.1 <<>> @ns1.rfasource.com www.rfa.com any ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15314 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;www.rfa.com. IN ANY ;; ANSWER SECTION: www.rfa.com. 3600 IN A 64.74.40.4 ;; Query time: 104 msec ;; SERVER: 66.151.213.9#53(ns1.rfasource.com) ;; WHEN: Fri Aug 6 07:53:55 2004 ;; MSG SIZE rcvd: 45 To me, this means that all DNS-replies that would give you an other ip for www.rfa.com, would be either compromised or manipulated. There is, of course, the stray possibility of rfa.com having "global loadbalancing" for it's website, meaning that the dns-reply will differ depending on the part of the world you're in, like IBM did a few years back, when hosting the site for the olympic games. Brgds Johan
-----Original Message----- From: travis.alexander () lacamas org [mailto:travis.alexander () lacamas org] Sent: den 5 augusti 2004 19:37 To: zhenshi99 () yahoo com; bugtraq () securityfocus com Subject: RE: International DNS compromise? I got six different results, meaning six different server IP's. 1. 64.33.99.47 2. 207.12.88.98 3. 208.56.31.43 4. 216.221.188.182 5. 65.160.219.113 6. 65.104.202.252 All US owned IP addresses. Yes this is very interesting. So what does this mean, or potentially mean...? Travis. -----Original Message----- From: Zhen Shi [mailto:zhenshi99 () yahoo com] Sent: Wednesday, August 04, 2004 10:11 PM To: bugtraq () securityfocus com Subject: International DNS compromise? Dear all, Recently I noticed something fishy in the DNS system between US and China. First, any IPs, dead or live, in China will respond to your DNS query for some domains. For example (screen shot with some clean-up and comments): C:\>nslookupserver 210.77.0.0 <=== pick a random IP inChina Default Server: [210.77.0.0] Address: 210.77.0.0www.rfa.orgServer: [210.77.0.0] Address: 210.77.0.0 Non-authoritative answer: Name: www.rfa.org Address: 203.105.1.21 <=== you got response!!!! Second, every time the response is different:www.rfa.orgServer: [210.77.0.0] Address: 210.77.0.0 Non-authoritative answer: Name: www.rfa.org Address: 64.66.163.251www.rfa.orgNon-authoritative answer: Name: www.rfa.org Address: 64.33.99.47www.rfa.orgNon-authoritative answer: Name: www.rfa.org Address: 128.121.126.139 Third, you can even get response from non-exist host names:nosuchhost.rfa.orgServer: [210.77.0.0] Address: 210.77.0.0 Non-authoritative answer: Name: nosuchhost.rfa.org Address: 65.104.202.252nosuchhost.rfa.orgNon-authoritative answer: Name: nosuchhost.rfa.org Address: 64.33.99.47 What on earth is really going on here? It seems the DNS system is messed up between US and China, and its integrity is compromised. People can be unknowingly redirected to any where ... --Zhen __________________________________ Do you Yahoo!? Take Yahoo! Mail with you! Get it on your mobile phone. http://mobile.yahoo.com/maildemo
Current thread:
- Re: International DNS compromise?, (continued)
- Re: International DNS compromise? john (Aug 05)
- Re: International DNS compromise? John Kinsella (Aug 05)
- Re: International DNS compromise? Troy (Aug 05)
- Re: International DNS compromise? Rio Martin. (Aug 06)
- Re: International DNS compromise? Danny (Aug 06)
- Re: International DNS compromise? John F. Waymouth (Aug 06)
- RE: International DNS compromise? travis . alexander (Aug 05)
- RE: International DNS compromise? Troy Monaghen (Aug 06)
- Re: International DNS compromise? bill (Aug 06)
- RE: International DNS compromise? Mike Clark (Aug 06)
- RE: International DNS compromise? Johan Nilsson (Aug 06)
- Re: International DNS compromise? Troy (Aug 06)