This is the mail archive of the cygwin@cygwin.com mailing list for the Cygwin project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: why is bash trying to access my DNS? [OT]


>On Mon, 2003-03-03 at 23:59, Randall R Schulz wrote:
>> Geoffrey,
>>=20
>> Exactly what sneaky data can get sent in a DNS request?
>> [...]
>
>Actually, plenty.  Historically, Bind has been easily hacked.  Although
>it's been a while since a good vulnerablity was found in Bind, that
>doesn't mean there's not an unknown hole in it which could be exploited.
>
>However, in order to exploit such a hole, the attacking system has to
>be, in one way or another, "owned".  Anybody with the presence of mind
>to be running ZoneAlarm (or something similar) would certianly know if
>there system(s) had been compromised in such a fashion.

Why is everybody assuming that a random host on the internet is running
a dns server on port 53? Consider this senario:

  I put my machine on the internet. I then put a udp listener at port
  53.  I then distribute software that knows how to create a udp packet
  to port 53 on my host. I can send anything I want to to that port,
  files, passwords, registry entries... Just because its going to a
  DNS port does not mean that its DNS data. It just means that its
  data for the service at that particular IP Address/Port number.

Now if you filter to certain hosts that you KNOW are running dns on
port 53, then that is different. However that means you must keep
updating the filter lists since I know my ISP changes my DNS servers
almost every time I dial up. (My guess is they have a couple of DNS
server per class C subnet/POP, but that's just a guess).

Running ZoneAlarm gives you a hint that something bad may be going on
when a program that shouldn't be making DNS queries starts making
them.  Or alternatively starts making queries tothe DNS port
on joe blow's computer rather than a local network computer.

				-- rouilj
John Rouillard
===========================================================================
My employers don't acknowledge my existence much less my opinions.

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Bug reporting:         http://cygwin.com/bugs.html
Documentation:         http://cygwin.com/docs.html
FAQ:                   http://cygwin.com/faq/


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]