July 23rd, 2008
Attack code published for DNS flaw
The urgency to patch Dan Kaminsky’s DNS cache poisoning vulnerability just went up a few notches.
Exploit code for the flaw, which allows the insertion of malicious DNS records into the cache of the target nameserver, has been added to Metasploit, a freely distributed attack/pen-testing tool.
According to Metasploit creator HD Moore (left), who teamed up with researcher |)ruid to create the exploit, a DNS service has also been created to assist with the exploit.
[ SEE: Vulnerability disclosure gone awry: Understanding the DNS debacle ]
The code, available here, takes aim at known deficiencies in the DNS protocol and common DNS implementations that aid in serious cache poisoning attacks.
This exploit caches a single malicious host entry into the target nameserver. By causing the target nameserver to query for random hostnames at the target domain, the attacker can spoof a response to the target server including an answer for the query, an authority server record, and an additional record for that server, causing target nameserver to insert the additional record into the cache.
In an IM exchange, Moore told me his exploit takes about a minute or two to poison a DNS cache but said he is working to improve it in version 2.0.
Kaminsky in on record as saying it is possible to launch a successful attack in a matter of seconds.
Patch now! Please.
For daily updates on Ryan's activities, follow him on Twitter.
