Date: Sat, 20 Feb 1999 21:20:13 -0800 From: Shane Wegner To: BUGTRAQ@netspace.org Subject: Possible DOS attack in the .nu domain service Hello all, I am not sure if this is known or even relevant to the list and if not, please excuse this post. There appears to be a bug in the niu DNS setup process which could result in a DOS attack for those using their domains. For those unfamiliar with niu, they provide sub-domain service under the .nu domain to machines which do there own DNS. I have written to them on several occasions about this issue but as of yet have received no response. OK the bug is that any user who is willing to pay the $25 to register a .nu domain can knock out or redirect a host under another. This is best shown through an example. I register mycompany.nu and in the registration form enter the hosts I have doing the DNS for it. Name: mycompany.nu DNS1: machine.someserver.com DNS2: machine2.someserver.com After this step, my DNS entry in the .nu table looks like this $ORIGIN nu. mycompany IN NS machine2.someserver.com. IN NS machine2.someserver.com. mycompany.nu for the sake of this example had the following DNS table. $ORIGIN nu. mycompany IN SOA mymachine.mycompany.nu. hostmaster.mycompany.nu. ( 1 301 120 604800 600 ) IN NS machine1.someserver.com. IN NS machine2.someserver.com. $ORIGIN mycompany.nu. mymachine IN A 192.168.1.1 So Al's well until someone registers evil.nu with the goal of knocking out myserver.mycompany.nu. On the form, they enter the following. name: evil.nu DNS1: mymachine.mycompany.nu DNS1IP: 127.0.0.1 Now here's the bug, if you enter an IP for a machine which falls under the .nu name-space, it maps it statically. It does not check to see if it falls under your name-space. Therefore, our evil.nu entry in the .nu table looks like this. $ORIGIN nu. evil IN NS mymachine.mycompany.nu. $ORIGIN mycompany.nu. mymachine IN A 127.0.0.1 So the IP for mymachine.mycompany.nu has been redirected from its 192.168.1.1 to 127.0.0.1. An attacker could conceivably redirect the mail servers of a company to his own machine or anything to that effect. Regards, Shane -- Shane Wegner: shane@cm.nu Tel: (604) 930-0530 Sysadmin, Continuum Systems: http://www.cm.nu Personal website: http://www.cm.nu/~shane ICQ UIN: 120000 PGP: keyid: 2048/F5C2BD91 Fingerprint: 8C 48 B9 D8 53 BB D8 EF 76 BB DB A2 1C 0D 1D 87