new DNS forwarder vulnerability

Sat Mar 15 16:36:09 UTC 2014

Good question, but the reality is that a lot of them are this way.  They just forward everything from any source.  Maybe it was designed that way to support DDoS as a use case.

Imagine a simple iptables rule like -p udp --dport 53 -j DNAT --to 4.2.2.4
I think some forwarders work this way - the LAN addresses can be reconfigured and so it's probably easier if the rule doesn't check the source address.. or maybe it was designed to work this way on purpose, because it's easy to explain as a 'bug' or oversight, rather than deliberate action.  Of course, it's crazy to think that some person or organization deliberately did this so they would have a practically unlimited amount of DoS sources.

-Laszlo

On Mar 15, 2014, at 4:26 PM, Gary Baribault <gary at baribault.net> wrote:

> Why would a CPE have an open DNS resolver from the WAN side?
> 
> Gary Baribault
> 
> On 03/14/2014 12:45 PM, Livingood, Jason wrote:
>> Well, at least all this CPE checks in for security updates every night so
>> this should be fixable. Oh wait, no, nevermind, they don't. :-(
>> 
>> 
>> This is getting to be the vulnerability of the week club for home gateway
>> devices - quite concerning.
>> 
>> JL
>> 
>> On 3/14/14, 12:05 PM, "Merike Kaeo" <merike at doubleshotsecurity.com> wrote:
>> 
>>> On Mar 14, 2014, at 7:06 AM, Stephane Bortzmeyer <bortzmeyer at nic.fr>
>>> wrote:
>>> 
>>>> On Fri, Mar 14, 2014 at 01:59:27PM +0000,
>>>> Nick Hilliard <nick at foobar.org> wrote
>>>> a message of 10 lines which said:
>>>> 
>>>>> did you characterise what dns servers / embedded kit were
>>>>> vulnerable?
>>>> He said "We have not been able to nail this vulnerability down to a
>>>> single box or manufacturer" so it seems the answer is No.
>>> 
>>> 
>>> It is my understanding  that many CPEs work off of same reference
>>> implementation(s).  I haven't
>>> had any cycles for this but with all the CPE issues out there it would be
>>> interesting to have
>>> a matrix of which CPEs utilize which reference implementation.  That may
>>> start giving some clues.
>>> 
>>> Has someone / is someone doing this?
>>> 
>>> - merike
>>> 
>> 
>> 
> 
> 