full-disclosure - Re: New Vulnerability against Firefox/ Major Extensions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a394e3d90705301007v4e917e4bo8cb5fe1e698eb1cf@mail.gmail.com>
Date: Wed, 30 May 2007 10:07:08 -0700
From: "Matthew Murphy" <mattmurphy@...rr.com>
To: steven@...urityzone.org
Cc: full-disclosure@...ts.grok.org.uk,
	Christopher Soghoian <csoghoian@...il.com>
Subject: Re: New Vulnerability against Firefox/ Major
	Extensions

On 5/30/07, Steven Adair <steven@...urityzone.org> wrote:
> We are also at risk from rogue developers, people that have
> hacked/poisoned your trusted DNS provider, those that have modified your
> /etc/hosts, /etc/resolv.conf, windows\system32\drivers\etc\hosts (and/or
> related files), people that have hacked the update server and put there
> own malicious version there, and the unlocked workstation attack from an
> attacker with a USB flash drive with a malicious update that might sit
> down at your workstation and -pwn- you.

Or, more simply, from a brute-force poisoning attack that doesn't
involve compromising the trusted DNS provider at all.  It's been known
for *at least as long as I've been in this business* that DNS is *not*
secure, even when both the DNS server and the requesting client are
not compromised.  There's no significant authentication of the DNS
server's reply, so DNS responses can be trivially spoofed by an
attacker who knows a window of time wherein you might request the
address of a particular host.

An example of such a condition: scheduled automatic updates.  That
just happens to be exactly what is described here.  You do the math.

This really should have been articulated in the original advisory,
IMO.  When applications depend on DNS for trust decisions, virtually
*every* internet connection is untrusted.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/