* Resolver behind NetFilter NAT service vulnerable to DNS poisoning attack [not found] <AANLkTikjFnoh_=PX7YDv18O46JhLFnyXQ9-f2CEumqRd@mail.gmail.com> @ 2010-09-02 13:50 ` Amir Herzberg 2010-09-02 14:04 ` Eric Dumazet 0 siblings, 1 reply; 4+ messages in thread From: Amir Herzberg @ 2010-09-02 13:50 UTC (permalink / raw) To: netfilter-devel We investigate some issues related to DNS poisoning, and specifically, an attack that poisons DNS cache, similar to Kaminski's attack, but that works even if the resolver selects random ports, as long as resolver is connected to the Internet via NAT. In particular, we tested the attack for the NetFilter NAT. For obvious reasons, I prefer at this point to share details only with developers of NAT devices. If you are such developer, please contact me and I can send you the details (paper). Feel also welcome to forward the messages to individuals/forums which may be relevant (i.e., developers). I apologize for not being able to promise to respond to requests from people who are just curious (i.e., not NAT developers). Thanks for your understanding. -- Amir Herzberg Associate Professor, Dept. of Computer Science Bar Ilan University http://AmirHerzberg.com -- Amir Herzberg Associate Professor, Dept. of Computer Science Bar Ilan University http://AmirHerzberg.com ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Resolver behind NetFilter NAT service vulnerable to DNS poisoning attack 2010-09-02 13:50 ` Resolver behind NetFilter NAT service vulnerable to DNS poisoning attack Amir Herzberg @ 2010-09-02 14:04 ` Eric Dumazet 2010-09-02 15:06 ` Amir Herzberg 0 siblings, 1 reply; 4+ messages in thread From: Eric Dumazet @ 2010-09-02 14:04 UTC (permalink / raw) To: Amir Herzberg; +Cc: netfilter-devel Le jeudi 02 septembre 2010 à 15:50 +0200, Amir Herzberg a écrit : > We investigate some issues related to DNS poisoning, and specifically, > an attack that poisons DNS cache, similar to Kaminski's attack, but > that works even if the resolver selects random ports, as long as > resolver is connected to the Internet via NAT. In particular, we > tested the attack for the NetFilter NAT. > > For obvious reasons, I prefer at this point to share details only with > developers of NAT devices. If you are such developer, please contact > me and I can send you the details (paper). > Feel also welcome to forward the messages to individuals/forums which > may be relevant (i.e., developers). > > I apologize for not being able to promise to respond to requests from > people who are just curious (i.e., not NAT developers). Thanks for > your understanding. > -- Strange, this should be supported since 2007 (port randomization for nat) commit 41f4689a7c8cd76b77864461b3c58fde8f322b2c Author: Eric Leblond <eric@inl.fr> Date: Wed Feb 7 15:10:09 2007 -0800 [NETFILTER]: NAT: optional source port randomization support This patch adds support to NAT to randomize source ports. Signed-off-by: Eric Leblond <eric@inl.fr> Signed-off-by: Patrick McHardy <kaber@trash.net> Signed-off-by: David S. Miller <davem@davemloft.net> If using MASQUERADE, its a very easy setup : iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Resolver behind NetFilter NAT service vulnerable to DNS poisoning attack 2010-09-02 14:04 ` Eric Dumazet @ 2010-09-02 15:06 ` Amir Herzberg 2010-09-02 18:24 ` Amir Herzberg 0 siblings, 1 reply; 4+ messages in thread From: Amir Herzberg @ 2010-09-02 15:06 UTC (permalink / raw) To: Eric Dumazet; +Cc: netfilter-devel, Haya Shulman Eric, thanks. I'm sorry for forgetting to mention this before, but the attack I referred to was against NAT _using_ port randomization, i.e. --random option (Netfilter from 2.4). We did _not_ refer to the known attack against NAT using port-preserving option (i.e., without port randomization). This attack is trivial when the DNS is not using port randomization, and we also show how to do this when the DNS is using port randomization. But the more challenging attack is when the NAT is using port randomization (--random). Of course, we also explain how to prevent these attacks. Cheers, Amir and Haya On Thu, Sep 2, 2010 at 4:04 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > Le jeudi 02 septembre 2010 à 15:50 +0200, Amir Herzberg a écrit : >> We investigate some issues related to DNS poisoning, and specifically, >> an attack that poisons DNS cache, similar to Kaminski's attack, but >> that works even if the resolver selects random ports, as long as >> resolver is connected to the Internet via NAT. In particular, we >> tested the attack for the NetFilter NAT. >> >> For obvious reasons, I prefer at this point to share details only with >> developers of NAT devices. If you are such developer, please contact >> me and I can send you the details (paper). >> Feel also welcome to forward the messages to individuals/forums which >> may be relevant (i.e., developers). >> >> I apologize for not being able to promise to respond to requests from >> people who are just curious (i.e., not NAT developers). Thanks for >> your understanding. >> -- > > Strange, this should be supported since 2007 (port randomization for > nat) > > commit 41f4689a7c8cd76b77864461b3c58fde8f322b2c > Author: Eric Leblond <eric@inl.fr> > Date: Wed Feb 7 15:10:09 2007 -0800 > > [NETFILTER]: NAT: optional source port randomization support > > This patch adds support to NAT to randomize source ports. > > Signed-off-by: Eric Leblond <eric@inl.fr> > Signed-off-by: Patrick McHardy <kaber@trash.net> > Signed-off-by: David S. Miller <davem@davemloft.net> > > If using MASQUERADE, its a very easy setup : > > iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random > > > > -- Amir Herzberg Associate Professor, Dept. of Computer Science Bar Ilan University http://AmirHerzberg.com -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: Resolver behind NetFilter NAT service vulnerable to DNS poisoning attack 2010-09-02 15:06 ` Amir Herzberg @ 2010-09-02 18:24 ` Amir Herzberg 0 siblings, 0 replies; 4+ messages in thread From: Amir Herzberg @ 2010-09-02 18:24 UTC (permalink / raw) To: netfilter-devel, Eric Dumazet; +Cc: Haya Shulman Eric, thanks. I'm sorry for forgetting to mention this before, but the attack I referred to was against NAT _using_ port randomization, i.e. --random option (Netfilter from 2.4). We did _not_ refer to the known attack against NAT using port-preserving option (i.e., without port randomization). This attack is trivial when the DNS is not using port randomization, and we also show how to do this when the DNS is using port randomization. But the more challenging attack is when the NAT is using port randomization (--random). Of course, we also explain how to prevent these attacks. Cheers, Amir and Haya On Thu, Sep 2, 2010 at 4:04 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote: > Le jeudi 02 septembre 2010 à 15:50 +0200, Amir Herzberg a écrit : >> We investigate some issues related to DNS poisoning, and specifically, >> an attack that poisons DNS cache, similar to Kaminski's attack, but >> that works even if the resolver selects random ports, as long as >> resolver is connected to the Internet via NAT. In particular, we >> tested the attack for the NetFilter NAT. >> >> For obvious reasons, I prefer at this point to share details only with >> developers of NAT devices. If you are such developer, please contact >> me and I can send you the details (paper). >> Feel also welcome to forward the messages to individuals/forums which >> may be relevant (i.e., developers). >> >> I apologize for not being able to promise to respond to requests from >> people who are just curious (i.e., not NAT developers). Thanks for >> your understanding. >> -- > > Strange, this should be supported since 2007 (port randomization for > nat) > > commit 41f4689a7c8cd76b77864461b3c58fde8f322b2c > Author: Eric Leblond <eric@inl.fr> > Date: Wed Feb 7 15:10:09 2007 -0800 > > [NETFILTER]: NAT: optional source port randomization support > > This patch adds support to NAT to randomize source ports. > > Signed-off-by: Eric Leblond <eric@inl.fr> > Signed-off-by: Patrick McHardy <kaber@trash.net> > Signed-off-by: David S. Miller <davem@davemloft.net> > > If using MASQUERADE, its a very easy setup : > > iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE --random > > > > -- Amir Herzberg Associate Professor, Dept. of Computer Science Bar Ilan University http://AmirHerzberg.com -- Amir Herzberg Associate Professor, Dept. of Computer Science Bar Ilan University http://AmirHerzberg.com -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2010-09-02 18:24 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <AANLkTikjFnoh_=PX7YDv18O46JhLFnyXQ9-f2CEumqRd@mail.gmail.com>
2010-09-02 13:50 ` Resolver behind NetFilter NAT service vulnerable to DNS poisoning attack Amir Herzberg
2010-09-02 14:04 ` Eric Dumazet
2010-09-02 15:06 ` Amir Herzberg
2010-09-02 18:24 ` Amir Herzberg
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).