RE: International DNS compromise?
Hi,
Did a little test, from a small isp in Sweden
- First, look up all records for www.rfa.com
# dig www.rfa.com any
; <<>> DiG 9.2.1 <<>> www.rfa.com any
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43829
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0
;; QUESTION SECTION:
;www.rfa.com. IN ANY
;; ANSWER SECTION:
www.rfa.com. 3600 IN A 64.74.40.4
;; AUTHORITY SECTION:
rfa.com. 172800 IN NS ns1.rfasource.com.
rfa.com. 172800 IN NS ns2.rfanyc.com.
rfa.com. 172800 IN NS ns3.rfanyc.com.
;; Query time: 299 msec
;; SERVER: 195.67.199.39#53(195.67.199.39)
;; WHEN: Fri Aug 6 07:51:13 2004
;; MSG SIZE rcvd: 116
- Second, lookup of www.rfa.com on one of the authorative servers
# dig @ns1.rfasource.com www.rfa.com any
; <<>> DiG 9.2.1 <<>> @ns1.rfasource.com www.rfa.com any
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15314
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;www.rfa.com. IN ANY
;; ANSWER SECTION:
www.rfa.com. 3600 IN A 64.74.40.4
;; Query time: 104 msec
;; SERVER: 66.151.213.9#53(ns1.rfasource.com)
;; WHEN: Fri Aug 6 07:53:55 2004
;; MSG SIZE rcvd: 45
To me, this means that all DNS-replies that would give you an other ip
for www.rfa.com, would be either compromised or manipulated.
There is, of course, the stray possibility of rfa.com having "global
loadbalancing" for it's website, meaning that the dns-reply will differ
depending on the part of the world you're in, like IBM did a few years
back, when hosting the site for the olympic games.
Brgds
Johan
> -----Original Message-----
> From: travis.alexander@xxxxxxxxxxx
> [mailto:travis.alexander@xxxxxxxxxxx]
> Sent: den 5 augusti 2004 19:37
> To: zhenshi99@xxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx
> Subject: RE: International DNS compromise?
>
> I got six different results, meaning six different server IP's.
>
> 1. 64.33.99.47
> 2. 207.12.88.98
> 3. 208.56.31.43
> 4. 216.221.188.182
> 5. 65.160.219.113
> 6. 65.104.202.252
>
> All US owned IP addresses. Yes this is very interesting. So
> what does this mean, or potentially mean...?
>
> Travis.
>
> -----Original Message-----
> From: Zhen Shi [mailto:zhenshi99@xxxxxxxxx]
> Sent: Wednesday, August 04, 2004 10:11 PM
> To: bugtraq@xxxxxxxxxxxxxxxxx
> Subject: International DNS compromise?
>
>
> Dear all,
> Recently I noticed something fishy in the DNS system
> between US and China.
> First, any IPs, dead or live, in China will respond to your
> DNS query for some domains. For example (screen shot with
> some clean-up and comments):
>
> C:\>nslookup
>
> > server 210.77.0.0 <=== pick a random IP in
> China
> Default Server: [210.77.0.0]
> Address: 210.77.0.0
>
> > www.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 203.105.1.21 <=== you got response!!!!
>
> Second, every time the response is different:
>
> > www.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 64.66.163.251
>
> > www.rfa.org
>
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 64.33.99.47
>
> > www.rfa.org
>
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 128.121.126.139
>
> Third, you can even get response from non-exist host
> names:
>
> > nosuchhost.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>
> Non-authoritative answer:
> Name: nosuchhost.rfa.org
> Address: 65.104.202.252
>
> > nosuchhost.rfa.org
>
> Non-authoritative answer:
> Name: nosuchhost.rfa.org
> Address: 64.33.99.47
>
> What on earth is really going on here? It seems the DNS
> system is messed up between US and China, and its integrity
> is compromised. People can be unknowingly redirected to any where ...
>
> --Zhen
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Take Yahoo! Mail with you! Get it on your mobile phone.
> http://mobile.yahoo.com/maildemo
>