Ruan Müller » dns http://ruanmuller.com Willing and not afraid to challenge the status quo. Wed, 14 Dec 2011 19:57:11 +0000 en hourly 1 http://wordpress.org/?v=3.3 New DoS Vulnerability Affects All Versions of BIND 9 http://ruanmuller.com/2009/07/29/new-dos-vulnerability-affects-all-versions-of-bind-9/ http://ruanmuller.com/2009/07/29/new-dos-vulnerability-affects-all-versions-of-bind-9/#comments Wed, 29 Jul 2009 17:35:30 +0000 Ruan http://ruanmuller.com/?p=301

ISC is reporting that a new, remotely exploitable vulnerability has been found in all versions of BIND 9. A specially crafted dynamic update packet will make BIND die with an assertion error. There is an exploit in the wild and there are no access control workarounds. Red Hat claims that the exploit does not affect BIND servers that do not allow dynamic updates, but the ISC post refutes that. This is a high-priority vulnerability and DNS operators will want to upgrade BIND to the latest patch level.

Via: Slashdot

]]> http://ruanmuller.com/2009/07/29/new-dos-vulnerability-affects-all-versions-of-bind-9/feed/ 0 DroneBL DDosed by DSL Modems and Routers infected by Botnet Worm http://ruanmuller.com/2009/03/23/dronebl-ddosed-by-dsl-modems-and-routers-infected-by-botnet-worm/ http://ruanmuller.com/2009/03/23/dronebl-ddosed-by-dsl-modems-and-routers-infected-by-botnet-worm/#comments Tue, 24 Mar 2009 03:06:25 +0000 Ruan http://ruanmuller.com/?p=252

“The people who bring you the DroneBL DNS Blacklist services, while investigating an ongoing DDoS incident, have discovered a botnet composed of exploited DSL modems and routers. OpenWRT/DD-WRT devices all appear to be vulnerable. What makes this worm impressive is the sophisticated nature of the bot, and the potential damage it can do not only to an unknowing end user, but to small businesses using non-commercial Internet connections, and to the unknowing public taking advantage of free Wi-Fi services. The botnet is believed to have infected 100,000 hosts.”

Poorly configured devices that allow remote administration access from the WAN side, combined with weak passwords for root, appears to be the reason for the successful proliferation of the worm.

Via Slashdot

]]> http://ruanmuller.com/2009/03/23/dronebl-ddosed-by-dsl-modems-and-routers-infected-by-botnet-worm/feed/ 0 New rogue DHCP server malware http://ruanmuller.com/2009/03/16/new-rogue-dhcp-server-malware/ http://ruanmuller.com/2009/03/16/new-rogue-dhcp-server-malware/#comments Tue, 17 Mar 2009 06:00:05 +0000 Ruan http://ruanmuller.com/?p=246 A bold new type of malware has been identified.  Its attack vector is based on hijacking the DNS settings for devices on a local area network. Any device regardless of operating system that depends on an internal or external name server can be affected.

The trojan configures and runs a rogue DHCP daemon on the infected host. Other devices on the same LAN are misled into using name servers settings provided by the trojan DHCP daemon for DNS lookups instead of using the origional configured name servers.

Devices on the network are then sent to fraudulent websites that can be more difficult to identify as imposters since the DNS lookups appear correct.

This is a more advanced attack of a well known vector of attacking a systems hosts file, but by being system agnostic and using the familiar DNS protocol, it is much more effective.

More details can be found at SANS

]]> http://ruanmuller.com/2009/03/16/new-rogue-dhcp-server-malware/feed/ 0