crossfire overtake soon !

by beAsty • 24 Jul 2008, 18:21 • Journals
some days ago an exploit came alive which allows to edit domains. means someone can copy crossfire on a new server(if he is able too.. exploit won´t do that part) and also edit the domain to that server. and if u enter crossfire.nu , you are on some other server where he could start loggin your pw/acc :o

Kamz doing that soon? god knows... but shoutout to fusen & netcoders.cc !!

I´m not 100% sure how it works and if every DNS is exploitable but as far as i read it is. And its not rly hard to use that exploit :o
So tbh i´m bit scared cause that shit could happen with ever site (bank,mails,msn,...)

@edit: also read that some german-bank sites are already exploited.. and on some sites there are also warning that u should wait with online.banking & stuff until this is fixxed :o
Comments
46
▼
finkregh 24 Jul 2008, 19:21
no worries!
▼
OfficerCohen 24 Jul 2008, 19:22
lol i wanted to write that :D
Parent
▼
zzaps 24 Jul 2008, 19:22
chaos theory
▼
beanhead 24 Jul 2008, 19:22
This has been known for ages.
▼
beAsty 24 Jul 2008, 19:24
exploit written at:
Release Date: 2008.07.23
published at thursday 24.7.08

@edit:
Exploit ID: CAU-EX-2008-0002
Release Date: 2008.07.23
Title: bailiwicked_host.rb
Description: Kaminsky DNS Cache Poisoning Flaw Exploit
Tested: BIND 9.4.1-9.4.2
Attributes: Remote, Poison, Resolver, Metasploit
Exploit URL: http://www.caughq.org/exploits/CAU-EX-2008-0002.txt
Author/Email: I)ruid <druid (@) caughq.org>
H D Moore <hdm (@) metasploit.com>
Parent
▼
Eddo 24 Jul 2008, 19:30
tbh its already been going on for at least 6 months
Parent
▼
beAsty 24 Jul 2008, 19:32
proof or i dont belive :(
Parent
▼
Eddo 24 Jul 2008, 19:38
was on some of those online game sites, some warning so guess they already found it out :P
Parent
▼
zerender 24 Jul 2008, 19:34
thats obviously a public one, private exploits are out for atleast months already
Parent
▼
beAsty 24 Jul 2008, 19:34
that one was private.. and now its published... but i´m not sure if it was thta long private.. dont think it tbh
Parent
▼
zerender 24 Jul 2008, 19:35
rofl bullshit
Parent
▼
dunno 24 Jul 2008, 19:52
you have no idea
Parent
▼
beAsty 24 Jul 2008, 20:06
true i´m not nerding enough to know all that :(
Parent
▼
dunno 24 Jul 2008, 20:18
you were nerdy enough to post it here
Parent
▼
beAsty 24 Jul 2008, 20:45
doesnt require to be rly nerdish
Parent
▼
beanhead 24 Jul 2008, 19:40
See, it's been out for ages:].
Parent
▼
ag0n 24 Jul 2008, 19:24
who cares? i use diferent passes for everything :)
▼
abort 24 Jul 2008, 19:29
http://www.milw0rm.com/exploits/6122 hf to the people who know how to use it ;)
▼
beAsty 24 Jul 2008, 19:31
lol i thought i wouldn´t post that.. cause there are 4 sure some guys which wanna try that now.. and then they get caught :D
Parent
▼
abort 24 Jul 2008, 19:32
haha they still have to know how to use it xD, as soon as they know that it's probably fixed! :}
Parent
▼
yellowpowerranger 24 Jul 2008, 19:39
no they use linux, too low for me
Parent
▼
dunno 24 Jul 2008, 20:08
it will not work in newest BIND server release afaik.
Parent
▼
Owzo 24 Jul 2008, 21:45
that would be people like me then i suppose ;D
Parent
▼
w0nd3r 24 Jul 2008, 19:39
what dumb trash...
▼
spng 24 Jul 2008, 19:45
dont care rly much my pass is a random one generated by xfire
▼
Deactivated7001 24 Jul 2008, 19:47
Damn, my password is my bank code. :/
▼
Puubuu 24 Jul 2008, 20:07
You just financed TosspoT's new sunglasses! Thank you!
Parent
▼
fredd 24 Jul 2008, 19:56
kamz will hack everyone that criticised his movie
▼
HellHammer 24 Jul 2008, 20:14
couldnt you just pm fusen?
▼
Ronner 24 Jul 2008, 20:17
It's been around for a while and several major companies who's products are affected with this exploit have been releasing patches a while ago. The exploit was kept a secret long enough for the companies to release patches and the actual exploit itself would be revealed on august 6th. Apparently it leaked.

The DNS protocol uses a 16bit key to identify the returning UDP packet. This key was supposed to be random, but they found that apparently it wasn't random enough. So if you attack a DNS server with massive ammounts of requests and that server isn't handling DNS for that domain (for instance crossfire.nu), it will request it from the DNS server that does handle the crossfire.nu domain. Meanwhile at the same time you send massive ammounts of return requests for WWW.crossfire.nu with random 16bit keys. With the bugged state you could get a validated returning packet into the targeted DNS server within about 10 seconds. The result would be that the IP given for www.crossfire.nu would be stored in the targeted DNS server for the amount of time that it expires (usually around 24 hours) so for the next 24 hours anyone using the targeted DNS server would get a different IP back for the request of www.crossfire.nu.

Not to worry though. Most ISP's have had plenty of time to patch their DNS servers. And if they didn't well tough luck :P
▼
roYal 24 Jul 2008, 20:21
if people hack ur bank account isnt it uselass or how do they get your TANs to send money?

[*asking that because my I use "asdasd" as my password for online banking]
▼
Tites 24 Jul 2008, 20:27
concerning online banking:

in general the web-adress should be https

&

in sweden you receive some kind of password remote-control. so you do not log in with passwords and usernames. one needs to type lots of numbers n stuff to finally log in, it's not complicated but very effective.
as far as i know, these remotes are not used in for example germany and probably many other countries
▼
Rhand 24 Jul 2008, 21:18
In Belgium @ Fortis (biggest bank) you get this electronic machine (it's like a calculator) and every time you want to log in on the Bank website you have to typ in a random code generated by that little machine. Same when you want to send money to a foreign country.

\ o /
Parent
▼
Tites 24 Jul 2008, 21:26
ye it's prolly the same, you have a static pin number to log into the "calculator" or remote and then you have to type codes listed from the homepage and so on..
Parent
▼
aSmOgAn 24 Jul 2008, 20:30
this sucks :/
▼
MindGamee 24 Jul 2008, 20:34
thx for the info :)

wont be logging into my bank account for a while :(
▼
dEzIrE 24 Jul 2008, 20:44
always look on the bright sight of life :~>
▼
jnz 24 Jul 2008, 21:09
sry but what a load of BS, even if they can change the domain nameservers to point elsewhere it doesn't mean in ANY way that you can access the server. Article or it never happened.
▼
Ronner 24 Jul 2008, 21:11
read my comment above.
Parent
▼
jnz 24 Jul 2008, 23:39
k thanks for the technical explanantion, but even with the DNS returning a different IP, it still doesn't give the attacker access to the server files, just the ability to display to the user whatever they want, which in itself is dangerous but not the same thing?
Parent
▼
Ronner 25 Jul 2008, 00:29
nah, not access to the serverfiles, but it could point a bunch of users that use the attacked and exploited DNS server to a different webserver and immitate the website they intended to visit and try to steal some account information and stuff like that.

but even that is hardly happening. The bug is a bit hyped. It's a serious bug, true, but it doesn't deserve this much hype imo.
Parent
Back to top