domain.nu.DoS.txt

`Date: Sat, 20 Feb 1999 21:20:13 -0800  
From: Shane Wegner <[email protected]>  
To: [email protected]  
Subject: Possible DOS attack in the .nu domain service  
  
Hello all,  
  
I am not sure if this is known or even relevant to the list and if not,  
please excuse this post.  
  
There appears to be a bug in the niu DNS setup process which could result  
in a DOS attack for those using their domains. For those unfamiliar with  
niu, they provide sub-domain service under the .nu domain to machines  
which do there own DNS. I have written to them on several occasions about  
this issue but as of yet have received no response.  
  
OK the bug is that any user who is willing to pay the $25 to register a  
.nu domain can knock out or redirect a host under another. This is best  
shown through an example.  
  
I register mycompany.nu and in the registration form enter the hosts I  
have doing the DNS for it.  
  
Name: mycompany.nu  
DNS1: machine.someserver.com  
DNS2: machine2.someserver.com  
  
After this step, my DNS entry in the .nu table looks like this  
  
$ORIGIN nu.  
mycompany IN NS machine2.someserver.com.  
IN NS machine2.someserver.com.  
  
mycompany.nu for the sake of this example had the following DNS table.  
  
$ORIGIN nu.  
mycompany IN SOA mymachine.mycompany.nu. hostmaster.mycompany.nu. (  
1 301 120 604800 600 )  
IN NS machine1.someserver.com.   
IN NS machine2.someserver.com.  
$ORIGIN mycompany.nu.  
mymachine IN A 192.168.1.1  
  
So Al's well until someone registers evil.nu with the goal of knocking out  
myserver.mycompany.nu. On the form, they enter the following.  
  
name: evil.nu  
DNS1: mymachine.mycompany.nu  
DNS1IP: 127.0.0.1  
  
Now here's the bug, if you enter an IP for a machine which falls under the  
.nu name-space, it maps it statically. It does not check to see if it  
falls under your name-space. Therefore, our evil.nu entry in the .nu  
table looks like this.  
  
$ORIGIN nu.  
evil IN NS mymachine.mycompany.nu.  
$ORIGIN mycompany.nu.  
mymachine IN A 127.0.0.1  
  
So the IP for mymachine.mycompany.nu has been redirected from its  
192.168.1.1 to 127.0.0.1. An attacker could conceivably redirect the mail  
servers of a company to his own machine or anything to that effect.  
  
Regards,  
Shane  
  
--   
Shane Wegner: [email protected]  
Tel: (604) 930-0530  
Sysadmin, Continuum Systems: http://www.cm.nu  
Personal website: http://www.cm.nu/~shane  
ICQ UIN: 120000  
PGP: keyid: 2048/F5C2BD91  
Fingerprint: 8C 48 B9 D8 53 BB D8 EF  
76 BB DB A2 1C 0D 1D 87  
  
`