SANS ISC: When attackers use your DNS to check for the sites you are visiting - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Nowadays, attackers are definitely interested in checking what sites you are visiting. Depending on that information, they can setup attacks like the following:

• Phising websites and e-mail scams targeted to specific people so they leave their private information.
• Network spoofing with tools like dsniff, where attackers can tell computers that the sites they want to visit are located somewhere else, therefore enabling them to interact with victims posing like the original site.

One of the most widely used techniques is DNS snooping, where the attacker checks for the DNS server of the domain what queries have been performed by the internal users and therefore letting see the attacker what sites have been visited.

A normal DNS query has the following information:

What does mean those fields? Let's check everyone of them:

• Transaction ID: It's used to match the request and reply packets so the computer is able to identificate which answer belongs to which question.
• Response: If set to 0 is a query packet. If set to 1 is a response packet.
• Opcode: We can find the following opcodes:

• Truncated: This flag indicates if only the first 512 bytes of the response is returned. Since this is a question, it is set to 0.
• Recursion Desired (RD): Instruct the DNS server whether or not to perform recursion to look for the answer of the query.
• Z: Used in old DNS implementations. If set to 1, only answers from the primary DNS of the destination zone is accepted (Check RFC5395)
• Non authenticated Data: Used in response packets. If set in 1, indicates that all data included in the answer and authority sections of the response have been authenticated by the server according to the policies of that server. Since this is a query packet, it is set to 0.
• Questions: Indicates the number of query structures present in the packet.
• Answer Resource Record (RR): Indicates the number of entries in the answer resource record list that were returned.
• Authority RR: Indicates the number of entries in the authority resource record list that were returned.
• Additional RR: Indicates the number of entries in the additional resource record list that were returned.
• Queries: List of queries included in the packet.

The answer of the last query is shown in the following figure:

The response code table for the DNS protocol is the following:

When an attacker performs the DNS cache snooping attack, it queries for specific domains without the RD bit set. If the DNS answers the query, then somebody from the inside requested access to that site and so it is cached in the DNS.

Let's see a DNS cache snooping attack query, which is a packet without the RD bit set:

How can we send several packets to test various domains? We can use a nmap script to perform the query for 100 domains already preconfigured:

Let's check the nmap options for the last figure:

• -sU: Performs UDP Scan
• -p 53: Performs the selected scan only to port 53
• 192.168.0.1: Place here the IP address you want to check.

We can see in the following figure a DNS with many cached registers:

How can you avoid this attack? In bind 9, there is a new feature called view, where you can limit the actions to ip ranges. Let's see an example:

view "external" {
    match-clients { any; };
    recursion no;
    zone "example.com" {
        type master;
        file "/etc/bind/externals/db.example.com";
        allow-transfer { slaves; };
    };
};
 

This configuration only allows to answer queries for example.com zone. Since the recursion no directive is set, it also defaults the allow-query-cache {none;};, which denies access to the cache server. You can use this with bind 9.4 and newer.

Manuel Humberto Santander Peláez
SANS Internet Storm Center - Handler
Twitter:@manuelsantander
Web:http://manuel.santander.name
e-mail: msantand at isc dot sans dot org