Re: International DNS compromise?

Troy · 06/08/04 02:15

It's probably the ISP you are using.
They are intercepting DNS requests and returning their
own replies. It could be something malicious, but it could
just as well be the ISP saving bandwidth by caching DNS queries.
If they cache DNS queries they probably cache www queries as
well. This is very common among ISPs outside the U.S., since
traffic out of the country tends to be a lot more expensive
than domestic traffic.

DNS is only as trustworthy as the companies who control
your network and those networks connected to it. The same
is true in China and everywhere else, including the U.S.

Troy

>
> Dear all,
> Recently I noticed something fishy in the DNS system
> between US and China.
> First, any IPs, dead or live, in China will respond
> to your DNS query for some domains. For example
> (screen shot with some clean-up and comments):
>
> C:\>nslookup
>
> > server 210.77.0.0 <=== pick a random IP in
> China
> Default Server: [210.77.0.0]
> Address: 210.77.0.0
>
> > www.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 203.105.1.21 <=== you got response!!!!
>
> Second, every time the response is different:
>
> > www.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 64.66.163.251
>
> > www.rfa.org
>
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 64.33.99.47
>
> > www.rfa.org
>
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 128.121.126.139
>
> Third, you can even get response from non-exist host
> names:
>
> > nosuchhost.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>
> Non-authoritative answer:
> Name: nosuchhost.rfa.org
> Address: 65.104.202.252
>
> > nosuchhost.rfa.org
>
> Non-authoritative answer:
> Name: nosuchhost.rfa.org
> Address: 64.33.99.47
>
> What on earth is really going on here? It seems the
> DNS system is messed up between US and China, and its
> integrity is compromised. People can be unknowingly
> redirected to any where ...
>
> --Zhen
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Take Yahoo! Mail with you! Get it on your mobile phone.
> http://mobile.yahoo.com/maildemo
>

John Kinsella · 06/08/04 03:45

On Wed, Aug 04, 2004 at 10:11:01PM -0700, Zhen Shi wrote:
> Non-authoritative answer:
> Name: nosuchhost.rfa.org
> Address: 64.33.99.47
>
> What on earth is really going on here? It seems the
> DNS system is messed up between US and China, and its
> integrity is compromised. People can be unknowingly
> redirected to any where ...

Think it's safe to say that's been the case with being behind the
China national firewall for a while.

Does this happen for other domain names? From what I know of the
Chinese government, they have no love for organizations like Radio Free
Asia...wouldn't surprise me if they're blocking blocking useful
responses, sending junk in return, and maybe even tracking who's trying
to go there.

John

travis.alexander@lacamas.org · 06/08/04 12:45

I got six different results, meaning six different server IP's.

1. 64.33.99.47
2. 207.12.88.98
3. 208.56.31.43
4. 216.221.188.182
5. 65.160.219.113
6. 65.104.202.252

All US owned IP addresses. Yes this is very interesting. So what
does this mean, or potentially mean...?

Travis.

-----Original Message-----
From: Zhen Shi [mailto:zhenshi99@yahoo.com]
Sent: Wednesday, August 04, 2004 10:11 PM
To: bugtraq@securityfocus.com
Subject: International DNS compromise?

Dear all,
Recently I noticed something fishy in the DNS system
between US and China.
First, any IPs, dead or live, in China will respond
to your DNS query for some domains. For example
(screen shot with some clean-up and comments):

C:\>nslookup

> server 210.77.0.0 <=== pick a random IP in
China
Default Server: [210.77.0.0]
Address: 210.77.0.0

> www.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0

Non-authoritative answer:
Name: www.rfa.org
Address: 203.105.1.21 <=== you got response!!!!

Second, every time the response is different:

> www.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0

Non-authoritative answer:
Name: www.rfa.org
Address: 64.66.163.251

> www.rfa.org

Non-authoritative answer:
Name: www.rfa.org
Address: 64.33.99.47

> www.rfa.org

Non-authoritative answer:
Name: www.rfa.org
Address: 128.121.126.139

Third, you can even get response from non-exist host
names:

> nosuchhost.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0

Non-authoritative answer:
Name: nosuchhost.rfa.org
Address: 65.104.202.252

> nosuchhost.rfa.org

Non-authoritative answer:
Name: nosuchhost.rfa.org
Address: 64.33.99.47

What on earth is really going on here? It seems the
DNS system is messed up between US and China, and its
integrity is compromised. People can be unknowingly
redirected to any where ...

--Zhen

__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo

07/08/04 02:25

In-Reply-To: <20040805192243.7826e6b9.john@pond-weed.com>

This is from China's "Great Firewall" sniffering their 54Gbps International traffic.

I presented some detailes at the HOPE conference in NYC last month. I posted the presentaion here: http://www.dit-inc.us/report/hope2004/cover.htm (click on the image to get in)

Regarding this DNS hijacking thing, it is worth mentioning that root DNS server in China may hijack query from neighbouring countries as well.

The black list for DNS hijacking is very small. TCP session hijacking list is longer, IP blocking blacklist is the longest.

Bill

>Received: (qmail 28891 invoked from network); 5 Aug 2004 18:45:36 -0000
>Received: from outgoing.securityfocus.com (HELO outgoing3.securityfocus.com) (205.206.231.27)
> by mail.securityfocus.com with SMTP; 5 Aug 2004 18:45:36 -0000
>Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id 03627236F36; Thu, 5 Aug 2004 12:47:21 -0600 (MDT)
>Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 28021 invoked from network); 5 Aug 2004 12:14:21 -0000
>Date: Thu, 5 Aug 2004 19:22:43 +0100
>From: john <john@pond-weed.com>
>To: bugtraq@securityfocus.com
>Subject: Re: International DNS compromise?
>Message-Id: <20040805192243.7826e6b9.john@pond-weed.com>
>In-Reply-To: <20040805051101.18767.qmail@web13702.mail.yahoo.co m>
>References: <Pine.LNX.4.58.0407232020010.3889@pluto.physik.u ni-wuerzburg.de>
> <20040805051101.18767.qmail@web13702.mail.yahoo.co m>
>X-Mailer: Sylpheed version 0.8.11claws (GTK+ 1.2.10; i686-pc-linux-gnu)
>Mime-Version: 1.0
>Content-Type: text/plain; charset=US-ASCII
>Content-Transfer-Encoding: 7bit
>
>On Wed, 4 Aug 2004 22:11:01 -0700 (PDT)
>Zhen Shi <zhenshi99@yahoo.com> wrote:
>
>> Dear all,
>> Recently I noticed something fishy in the DNS system
>> between US and China.
>> First, any IPs, dead or live, in China will respond
>> to your DNS query for some domains. For example
>> (screen shot with some clean-up and comments):
>>
>> C:\>nslookup
>>
>> > server 210.77.0.0 <=== pick a random IP in
>> China
>> Default Server: [210.77.0.0]
>> Address: 210.77.0.0
>>
>> > www.rfa.org
>> Server: [210.77.0.0]
>> Address: 210.77.0.0
>>
>> Non-authoritative answer:
>> Name: www.rfa.org
>> Address: 203.105.1.21 <=== you got response!!!!
>>
>> Second, every time the response is different:
>>
>> > www.rfa.org
>> Server: [210.77.0.0]
>> Address: 210.77.0.0
>>
>> Non-authoritative answer:
>> Name: www.rfa.org
>> Address: 64.66.163.251
>
>> <snip>
>
>It looks like it all works OK with most domain names. But rfa.org is the
>sort of site the Chinese would want to censor. Evidently this is part of
>their strategy for doing that.
>
>This has the side-effect that you could discover the list of sites being
>censored by systematically comparing DNS replies from a server in China
>with those from an uncompromised server.
>
>John
>

Mike Clark · 07/08/04 14:35

I've seen this before with companies that provide content for people in
China. The last company I talked to about this used proxy servers and
had people hosting content all over the country(US)to avoid the
filtering/blocking by the Chinese government. It seemed to work pretty
well.

-Mike

-----Original Message-----
From: travis.alexander@lacamas.org [mailto:travis.alexander@lacamas.org]

Sent: Thursday, August 05, 2004 10:37 AM
To: zhenshi99@yahoo.com; bugtraq@securityfocus.com
Subject: RE: International DNS compromise?=20

I got six different results, meaning six different server IP's.

1. 64.33.99.47
2. 207.12.88.98
3. 208.56.31.43
4. 216.221.188.182
5. 65.160.219.113
6. 65.104.202.252

All US owned IP addresses. Yes this is very interesting. So what does
this mean, or potentially mean...?

Travis.

-----Original Message-----
From: Zhen Shi [mailto:zhenshi99@yahoo.com]
Sent: Wednesday, August 04, 2004 10:11 PM
To: bugtraq@securityfocus.com
Subject: International DNS compromise?=20

Dear all,
Recently I noticed something fishy in the DNS system
between US and China.=20
First, any IPs, dead or live, in China will respond
to your DNS query for some domains. For example
(screen shot with some clean-up and comments):=20

C:\>nslookup

> server 210.77.0.0 <=3D=3D=3D pick a random IP in
China=20
Default Server: [210.77.0.0]
Address: 210.77.0.0

> www.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0

Non-authoritative answer:
Name: www.rfa.org
Address: 203.105.1.21 <=3D=3D=3D you got response!!!!

Second, every time the response is different:=20

> www.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0

Non-authoritative answer:
Name: www.rfa.org
Address: 64.66.163.251

> www.rfa.org

Non-authoritative answer:
Name: www.rfa.org
Address: 64.33.99.47

> www.rfa.org

Non-authoritative answer:
Name: www.rfa.org
Address: 128.121.126.139

Third, you can even get response from non-exist host
names:=20

> nosuchhost.rfa.org
Server: [210.77.0.0]
Address: 210.77.0.0

Non-authoritative answer:
Name: nosuchhost.rfa.org
Address: 65.104.202.252

> nosuchhost.rfa.org

Non-authoritative answer:
Name: nosuchhost.rfa.org
Address: 64.33.99.47

What on earth is really going on here? It seems the
DNS system is messed up between US and China, and its
integrity is compromised. People can be unknowingly
redirected to any where ...=20

--Zhen

=09
__________________________________
Do you Yahoo!?
Take Yahoo! Mail with you! Get it on your mobile phone.
http://mobile.yahoo.com/maildemo=20

Troy Monaghen · 07/08/04 15:35

On Thu, 2004-08-05 at 12:37, travis.alexander@lacamas.org wrote:
> I got six different results, meaning six different server IP's.

> -----Original Message-----
> From: Zhen Shi [mailto:zhenshi99@yahoo.com]
>
> Dear all,
> Recently I noticed something fishy in the DNS system
> between US and China.

Looks like rfa.org uses Speedera (see the log of finding and querying
the authoritative name servers below). To quote from their web site at
http://www.speedera.com/primary/Tech/Over.htm : "Speedera's highly
distributed, robust network relies on a worldwide set of probes and
global traffic managers to make real-time decisions to intelligently
route users' requests to the best location and best server."

It sounds like this is just part of Speedera's attempt to route users to
the appropriate server.

$ whois rfa.org
...
Name Server

NSAUTH1.SYS.GTEI.NET
Name Server

NSAUTH2.SYS.GTEI.NET
Name Server

NSAUTH3.SYS.GTEI.NET

$ host www.rfa.org DNSAUTH1.SYS.GTEI.NET
...
www.rfa.org is an alias for www.rfaweb.org.

$ whois rfaweb.org
...
Name Server

NS31.REGISTER.COM
Name Server

NS32.REGISTER.COM

$ host www.rfaweb.org DNS31.REGISTER.COM
...
www.rfaweb.org is an alias for rfa.speedera.net.

$ whois speedera.net
...
Domain servers in listed order:
Q.SPEEDERA.NET 64.41.192.113
L.SPEEDERA.NET 64.0.96.22
N.SPEEDERA.NET 65.169.170.140
F.SPEEDERA.NET 210.224.186.3
A.SPEEDERA.NET 208.185.54.61
H.SPEEDERA.NET 64.14.117.35
Y.SPEEDERA.NET 212.187.170.30
Z.SPEEDERA.NET 216.200.69.12

$ host rfa.speedera.net Q.SPEEDERA.NET
...
rfa.speedera.net has address 208.254.75.133
rfa.speedera.net has address 66.7.159.165

$ host rfa.speedera.net L.SPEEDERA.NET
...
rfa.speedera.net has address 64.37.246.4
rfa.speedera.net has address 64.37.246.3

$ host rfa.speedera.net N.SPEEDERA.NET
...
rfa.speedera.net has address 65.216.78.76
rfa.speedera.net has address 64.37.246.4

$ host rfa.speedera.net F.SPEEDERA.NET
...
rfa.speedera.net has address 65.216.78.76
rfa.speedera.net has address 64.37.246.4

$ host rfa.speedera.net A.SPEEDERA.NET
...
rfa.speedera.net has address 65.216.78.76
rfa.speedera.net has address 64.28.86.231

$ host rfa.speedera.net H.SPEEDERA.NET
...
rfa.speedera.net has address 65.216.78.76
rfa.speedera.net has address 64.156.240.39

$ host rfa.speedera.net Y.SPEEDERA.NET
...
rfa.speedera.net has address 216.74.133.196
rfa.speedera.net has address 64.156.240.39

$ host rfa.speedera.net Z.SPEEDERA.NET
...
rfa.speedera.net has address 64.156.240.39
rfa.speedera.net has address 216.74.133.196

--
Troy

Rio Martin. · 07/08/04 15:55

On 06 August 2004 am 00:49, Troy wrote:
> It's probably the ISP you are using.
> They are intercepting DNS requests and returning their
> own replies. It could be something malicious, but it could
> just as well be the ISP saving bandwidth by caching DNS queries.
> If they cache DNS queries they probably cache www queries as
> well. This is very common among ISPs outside the U.S., since
> traffic out of the country tends to be a lot more expensive
> than domestic traffic.
> DNS is only as trustworthy as the companies who control
> your network and those networks connected to it. The same
> is true in China and everywhere else, including the U.S.
> Troy

Or perhaps they are one of 'Akamai likes' members.
We could see them running lots of servers while those servers actually just a
cache server to perform load balance.

- Rio.Martin -

Danny · 07/08/04 16:55

On Thu, 5 Aug 2004 10:49:39 -0700 (PDT), Troy <tjk@tksoft.com> wrote:
> It's probably the ISP you are using.
> They are intercepting DNS requests and returning their
> own replies. It could be something malicious, but it could
> just as well be the ISP saving bandwidth by caching DNS queries.

I have never heard of an ISP which does not cache (Bind does by
default) DNS queries. If they did not, their DNS servers would be
constantly hitting the root servers, which would be horribly
inconsiderate.

> If they cache DNS queries they probably cache www queries as
> well.

See my last comment.

....D

Johan Nilsson · 08/08/04 11:15

Hi,

Did a little test, from a small isp in Sweden

- First, look up all records for www.rfa.com
# dig www.rfa.com any=20

; <<>> DiG 9.2.1 <<>> www.rfa.com any
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 43829
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 0

;; QUESTION SECTION:
;www.rfa.com. IN ANY

;; ANSWER SECTION:
www.rfa.com. 3600 IN A 64.74.40.4

;; AUTHORITY SECTION:
rfa.com. 172800 IN NS ns1.rfasource.com.
rfa.com. 172800 IN NS ns2.rfanyc.com.
rfa.com. 172800 IN NS ns3.rfanyc.com.

;; Query time: 299 msec
;; SERVER: 195.67.199.39#53(195.67.199.39)
;; WHEN: Fri Aug 6 07:51:13 2004
;; MSG SIZE rcvd: 116=20

- Second, lookup of www.rfa.com on one of the authorative servers
# dig @ns1.rfasource.com www.rfa.com any

; <<>> DiG 9.2.1 <<>> @ns1.rfasource.com www.rfa.com any
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15314
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;www.rfa.com. IN ANY

;; ANSWER SECTION:
www.rfa.com. 3600 IN A 64.74.40.4

;; Query time: 104 msec
;; SERVER: 66.151.213.9#53(ns1.rfasource.com)
;; WHEN: Fri Aug 6 07:53:55 2004
;; MSG SIZE rcvd: 45

To me, this means that all DNS-replies that would give you an other ip
for www.rfa.com, would be either compromised or manipulated.

There is, of course, the stray possibility of rfa.com having "global
loadbalancing" for it's website, meaning that the dns-reply will differ
depending on the part of the world you're in, like IBM did a few years
back, when hosting the site for the olympic games.

Brgds
Johan

> -----Original Message-----
> From: travis.alexander@lacamas.org=20
> [mailto:travis.alexander@lacamas.org]=20
> Sent: den 5 augusti 2004 19:37
> To: zhenshi99@yahoo.com; bugtraq@securityfocus.com
> Subject: RE: International DNS compromise?=20
>=20
> I got six different results, meaning six different server IP's.
>=20
> 1. 64.33.99.47
> 2. 207.12.88.98
> 3. 208.56.31.43
> 4. 216.221.188.182
> 5. 65.160.219.113
> 6. 65.104.202.252
>=20
> All US owned IP addresses. Yes this is very interesting. So=20
> what does this mean, or potentially mean...?
>=20
> Travis.
>=20
> -----Original Message-----
> From: Zhen Shi [mailto:zhenshi99@yahoo.com]
> Sent: Wednesday, August 04, 2004 10:11 PM
> To: bugtraq@securityfocus.com
> Subject: International DNS compromise?=20
>=20
>=20
> Dear all,
> Recently I noticed something fishy in the DNS system=20
> between US and China.=20
> First, any IPs, dead or live, in China will respond to your=20
> DNS query for some domains. For example (screen shot with=20
> some clean-up and comments):=20
>=20
> C:\>nslookup
>=20
> > server 210.77.0.0 <=3D=3D=3D pick a random IP in
> China
> Default Server: [210.77.0.0]
> Address: 210.77.0.0
>=20
> > www.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>=20
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 203.105.1.21 <=3D=3D=3D you got response!!!!
>=20
> Second, every time the response is different:=20
>=20
> > www.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>=20
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 64.66.163.251
>=20
> > www.rfa.org
>=20
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 64.33.99.47
>=20
> > www.rfa.org
>=20
> Non-authoritative answer:
> Name: www.rfa.org
> Address: 128.121.126.139
>=20
> Third, you can even get response from non-exist host
> names:=20
>=20
> > nosuchhost.rfa.org
> Server: [210.77.0.0]
> Address: 210.77.0.0
>=20
> Non-authoritative answer:
> Name: nosuchhost.rfa.org
> Address: 65.104.202.252
>=20
> > nosuchhost.rfa.org
>=20
> Non-authoritative answer:
> Name: nosuchhost.rfa.org
> Address: 64.33.99.47
>=20
> What on earth is really going on here? It seems the DNS=20
> system is messed up between US and China, and its integrity=20
> is compromised. People can be unknowingly redirected to any where ...=20
>=20
> --Zhen
>=20
>=20
>=20
> =09
> __________________________________
> Do you Yahoo!?
> Take Yahoo! Mail with you! Get it on your mobile phone.
> http://mobile.yahoo.com/maildemo=20
>=20

John F. Waymouth · 08/08/04 11:55

On Thu, 5 Aug 2004, Troy wrote:

> It's probably the ISP you are using.

No, I'm seeing the same results, as did a previous replier. I'm on SpeakEasy
DSL in the USA, which is reknowned for its non-interfering policies. It's
pretty clearly interference on China's end.

(routing emails to this address > /dev/null for the time being, please reply
to the list)

Troy · 08/08/04 12:45

Caching DNS (i.e. doing transparent proxying for DNS) means
that the ISP intercepts all DNS traffic. The caching you refer
to only applies when users are using the ISP's name servers.

I don't know of any ISP who would be intercepting DNS queries.

When you use nslookup and specify a server, the query is sent directly
to the server you specify, not the name server of your ISP.

Cheers,

Troy

>
> On Thu, 5 Aug 2004 10:49:39 -0700 (PDT), Troy <tjk@tksoft.com> wrote:
> > It's probably the ISP you are using.
> > They are intercepting DNS requests and returning their
> > own replies. It could be something malicious, but it could
> > just as well be the ISP saving bandwidth by caching DNS queries.
>
> I have never heard of an ISP which does not cache (Bind does by
> default) DNS queries. If they did not, their DNS servers would be
> constantly hitting the root servers, which would be horribly
> inconsiderate.
>
> > If they cache DNS queries they probably cache www queries as
> > well.
>
> See my last comment.
>
> ...D
>

Onderwerp Gereedschap

Toon

Onderwerp: Re: International DNS compromise?