RE: International DNS compromise?

["Johan Nilsson" <johan.nilsson@xxxxxxxx>]

Hi,

Did a little test, from a small isp in Sweden

- First, look up all records for www.rfa.com
# dig www.rfa.com any 

; <<>> DiG 9.2.1 <<>> www.rfa.com any
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43829
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0

;; QUESTION SECTION:
;www.rfa.com.                   IN      ANY

;; ANSWER SECTION:
www.rfa.com.            3600    IN      A       64.74.40.4

;; AUTHORITY SECTION:
rfa.com.                172800  IN      NS      ns1.rfasource.com.
rfa.com.                172800  IN      NS      ns2.rfanyc.com.
rfa.com.                172800  IN      NS      ns3.rfanyc.com.

;; Query time: 299 msec
;; SERVER: 195.67.199.39#53(195.67.199.39)
;; WHEN: Fri Aug  6 07:51:13 2004
;; MSG SIZE  rcvd: 116 

- Second, lookup of www.rfa.com on one of the authorative servers
# dig @ns1.rfasource.com www.rfa.com any

; <<>> DiG 9.2.1 <<>> @ns1.rfasource.com www.rfa.com any
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15314
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.rfa.com.                   IN      ANY

;; ANSWER SECTION:
www.rfa.com.            3600    IN      A       64.74.40.4

;; Query time: 104 msec
;; SERVER: 66.151.213.9#53(ns1.rfasource.com)
;; WHEN: Fri Aug  6 07:53:55 2004
;; MSG SIZE  rcvd: 45

To me, this means that all DNS-replies that would give you an other ip
for www.rfa.com, would be either compromised or manipulated.

There is, of course, the stray possibility of rfa.com having "global
loadbalancing" for it's website, meaning that the dns-reply will differ
depending on the part of the world you're in, like IBM did a few years
back, when hosting the site for the olympic games.

Brgds
Johan

> -----Original Message-----
> From: travis.alexander@xxxxxxxxxxx 
> [mailto:travis.alexander@xxxxxxxxxxx] 
> Sent: den 5 augusti 2004 19:37
> To: zhenshi99@xxxxxxxxx; bugtraq@xxxxxxxxxxxxxxxxx
> Subject: RE: International DNS compromise? 
> 
> I got six different results, meaning six different server IP's.
> 
> 1. 64.33.99.47
> 2. 207.12.88.98
> 3. 208.56.31.43
> 4. 216.221.188.182
> 5. 65.160.219.113
> 6. 65.104.202.252
> 
> All US owned IP addresses. Yes this is very interesting. So 
> what does this mean, or potentially mean...?
> 
> Travis.
> 
> -----Original Message-----
> From: Zhen Shi [mailto:zhenshi99@xxxxxxxxx]
> Sent: Wednesday, August 04, 2004 10:11 PM
> To: bugtraq@xxxxxxxxxxxxxxxxx
> Subject: International DNS compromise? 
> 
> 
> Dear all,
>   Recently I noticed something fishy in the DNS system 
> between US and China. 
>   First, any IPs, dead or live, in China will respond to your 
> DNS query for some domains. For example (screen shot with 
> some clean-up and comments): 
> 
> C:\>nslookup
> 
> > server 210.77.0.0     <=== pick a random IP     in
> China
> Default Server:  [210.77.0.0]
> Address:  210.77.0.0
> 
> > www.rfa.org
> Server:  [210.77.0.0]
> Address:  210.77.0.0
> 
> Non-authoritative answer:
> Name:    www.rfa.org
> Address:  203.105.1.21  <=== you got response!!!!
> 
>   Second, every time the response is different: 
> 
> > www.rfa.org
> Server:  [210.77.0.0]
> Address:  210.77.0.0
> 
> Non-authoritative answer:
> Name:    www.rfa.org
> Address:  64.66.163.251
> 
> > www.rfa.org
> 
> Non-authoritative answer:
> Name:    www.rfa.org
> Address:  64.33.99.47
> 
> > www.rfa.org
> 
> Non-authoritative answer:
> Name:    www.rfa.org
> Address:  128.121.126.139
> 
>  Third, you can even get response from non-exist host
> names: 
> 
> > nosuchhost.rfa.org
> Server:  [210.77.0.0]
> Address:  210.77.0.0
> 
> Non-authoritative answer:
> Name:    nosuchhost.rfa.org
> Address:  65.104.202.252
> 
> > nosuchhost.rfa.org
> 
> Non-authoritative answer:
> Name:    nosuchhost.rfa.org
> Address:  64.33.99.47
> 
>   What on earth is really going on here? It seems the DNS 
> system is messed up between US and China, and its integrity 
> is compromised. People can be unknowingly redirected to any where ... 
> 
> --Zhen
> 
> 
> 
>               
> __________________________________
> Do you Yahoo!?
> Take Yahoo! Mail with you! Get it on your mobile phone.
> http://mobile.yahoo.com/maildemo 
>