security-scripts/dns/zodiac/doc/README

zodiac - advanced dns spoofer

readme file



 0. content

    compilation ......................................................  1
    features and description .........................................  2
    overview of weak points in the domain name service ...............  3
    spoofing descriptions ............................................  4
    hints for effective spoofing .....................................  5

    about ............................................................  6
    greetings ........................................................  7

    legal stuff / disclaimer .........................................  8



 1. compilation

    read "INSTALL"

 2. features and description

    basic features include:

DONE  - sniffing of dns datagrams on an ethernet device
DONE  - decoding of all types of dns packets, including safe decompression
?     - nice display and gui
DONE  - always interactive in all situations
DONE  - threaded and flexible design

    advanced features include:

DONE? - local dns spoof
      - jizz dns spoof, exploiting a weakness in some named's implementations
      - determines jizz-weakness, id-prediction and resolver type remotely
      - id spoofing, exploiting a weakness in the dns protocol itself
      - implements some advanced dns denial of service attacks, including
        flood, label compression and unres attack, advanced dns smurf


 3. overview of weak points in the domain name service

    - connectionless, udp based, independent protocol

      the dns protocol can utilize tcp and udp as transportation protocols.
      however, nearly all domain name servers use udp, because it has two
      great advantages over tcp: it has little overhead and it doesn't need
      time to establish a connection, it can just send data directly.

      this is one of the reasons why the dns protocol is attackable, because
      it uses a stateless protocol to deliver it's data, and extends this with
      just some weak state variables inside the dns header.

      stateless protocols can be spoofed easily, this is true for udp also. so
      the spoof-security has to be guaranteed by the protocol on top of it, in
      this case the dns protocol.

    - broad usage, compatibility over security

      since the dns protocol is very popular it has to be compatible with as
      much servers as possible. the dns standard is written down in two
      technical documents, the so called rfc's, for dns it is rfc 1034 and
      1035.
      a dns server often has to handle hundrets of requests from hundrets of
      different machines at the same time, to understand them they have to fit
      the format defined in the rfc's, any violation may render the request
      to be dropped. this makes it nearly impossible to extend the dns protocol
      within the tight borders given by the rfc.

    - old, ineffective

      the dns protocol we use today has been established 1987. at this time
      the internet was not as popular as today, and although there has been
      incidents in which protocol security has been compromised there was no
      real sense of security when the protocol was designed.

      therefore the protocol is functional and obviously working but is
      lacking any security implementation. the dns id was never intended to be
      used for security, just to sort the answers of the remote dns server
      more quickly (the same applies to the isn of a tcp connection, they were
      never intended to stop ip/tcp spoofing).

      also dns turned out to be a quite ineffective protocol in large net-
      works. there are estimations that 20% of all internet traffic are dns
      traffic. dns caching is used to avoid too much traffic, therefore
      exposing another way to compromise dns security.

      also the dns protocol is centralized, which means there are more
      important computers than others in dns design, therefore it's clearly
      obvious which computers are subject to attacks (those that cache for
      many computers).


 4. spoofing descriptions

    not yet

 5. hints for effective spoofing

    not yet

 6. about

    the program has been written by members of team teso and smiler.
    a helpful patch has been submitted by noah williamsson <tm@ns2.crw.se>.

    the vulnerabilities the program exploits have been discovered by other
    persons, the adm crew deserves credit for the dns id spoofing technique.

    the dozends of mindful people from the bugtraq mailing list that messed
    with dns also deserve credits :)


 7. greetings

    (from scut)

      in alphabetical order :-D

      acpizer, avoozl, axhate, blackb, blow, bigblue, crestor, davy, domnar,
      edi, focht, foxfire, fungus, garry, hendy, hoopy, js, kafka, lorian,
      mindtrip, moc, overhead, oxigen, packwahn, plasmoid, random, route,
      smiler, spy, tb303, tis, toniq, typo, vax, waterloo, wildandi, wilkins,
      yks, yodler, zap. 

      special greetings to

        smiler, :-)
        the adm crew, for finding the id vulnerability, but lack a good coding
          style ;-)
        foxfire, for giving me some nice packet dumps to play with
        oxigen, for giving me some hints about dns spoofing
        rfc1035, for giving me any information about any dns packet
        ken williams, for just being so cool B-)


 8. legal stuff / disclaimer

    know what you do before you do it, be able to face it's consequences.