My Grey Cells Burning

Tuesday, August 07, 2007
DNS Rebinding Exploit And How I Fix The Javascript Vulnerabilities.



image source: http://www.neatorama.com/2005/10/22/the-cuban-computer/


Read about DNS rebinding attacks on Slashdot did make curiosity arise and those grey cells urged me to want to find out more about that since several Web and Mail server under my own supervision are working fine now and I of course doesn't want anything bad happen to my babies in the later future.

Query dancing on ChaCha reveals lot infos on DNS rebinding attacks howto which can be seen here and here... and here too. People can download the white paper describing the attack in details. But the easiest explanations can be found at Christian Matthias blog. Basically, this attacks will exploit DNS Pinning to steal informations. In short, "When someone requests a Web site such as www.example.com, the browser needs to perform a DNS lookup on that domain to get the associated numerical address (IP) of the server that hosts the Web site in question. In the next step, the browser sends a query to that IP that moreover contains the domain, a specific Web page and other variables to be able to ultimately retrieve the requested data." More informations and examples can be found at Mr Matthias blog.

Although the concepts look simple, but then the attacker will have hard time implementing it. As said by Mike Malone, "Though the concept is fairly simple, we agreed that it would be difficult to perform this sort of attack in practice. An attacker would need to have intimate knowledge of the victims internal network, or rely on Flash or other web technologies to perform a network scan. Moreover, an attack would end as soon as the victim closed their web browser". In short, get secure or your preferred unsecured browser will betray you silently.

Enough with devouring explanations, curiosity then move me on to this site here at jumperz.com to check whether I can run the exploit on my servers and also this host using the said exploit. This site will sent data from your private ip to www.jumperz.net to demonstrate how easy that is to steal informations using Anti-DNS Pinning attack. For this moment, I only target on localhost, web server and a mail server under my own supervision.

Entering the 127.0.0.1 into the box reveal failed attempt as shown below:

http://1186491925437.jumperz.net/exploits/dnsp3.jsp?address=127.0.0.1

Please wait for 120 seconds.
f1()
ERROR: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIXMLHttpRequest.send]" nsresult: "0x80004005 (NS_ERROR_FAILURE)" location: "JS frame :: http://1186491925437.jumperz.net/exploits/dnsp3.jsp?address=127.0.0.1 :: f2 :: line 50" data: no]
ERROR:
ERROR: 0


(Which is differ with the result upon visiting to DNS rebinding site that shows the "We have detected that your browser is vulnerable to efficient DNS rebinding attacks" message).


Exploiting mail server also show failed attempts due to https redirection:

http://1286451923437.jumperz.net/exploits/dnsp3.jsp?address=xxx.xxx.24.219


<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
Reason: You\'re speaking plain HTTP to an SSL-enabled server port.<br />
Instead use the HTTPS scheme to access this URL, please.<br />
<blockquote>Hint: <a href=\"https://mail.gov.my/\"><b>https://mail.gov.my/</b></a></blockquote></p>
</body></html>


And the most interesting result come from my web server with successful attempt(?) and part of the codes are shown below:

http://1184918537.jumperz.net/exploits/dnsp3.jsp?address=xxx.xxx.35.208

<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Transitional//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd\">
<html xmlns=\"http://www.w3.org/1999/xhtml\">
<head>
<!--[if gte IE 5.5000]>
<script language=\"JavaScript\">
function correctPNG()
{ for(var i=0; i<document.images.length; i++)
{ var img = document.images[i]
var imgName = img.src.toUpperCase()
if (imgName.substring(imgName.length-3, imgName.length) == \"PNG\")
{ var imgID = (img.id) ? \"id=\'\" + img.id + \"\' \" : \"\"
var imgClass = (img.className) ? \"class=\'\" + img.className + \"\' \" : \"\"
var imgTitle = (img.title) ? \"title=\'\" + img.title + \"\' \" : \"title=\'\" + img.alt + \"\' \"
var imgStyle = \"display:inline-block;\" + img.style.cssText
if (img.align == \"left\") imgStyle = \"float:left;\" + imgStyle
if (img.align == \"right\") imgStyle = \"float:right;\" + imgStyle
if (img.parentElement.href) imgStyle = \"cursor:hand;\" + imgStyle
var strNewHTML = \"<span \" + imgID + imgClass + imgTitle
+ \" style=\\\"\" + \"width:\" + img.width + \"px; height:\" + img.height + \"px;\" + imgStyle + \";\"
+ \"filter:progid:DXImageTransform.Microsoft.AlphaImageLoader\"
+ \"(src=\\\'\" + img.src + \"\\\', sizingMethod=\'scale\');\\\"></span>\"
img.outerHTML = strNewHTML
i = i-1
}}}
window.attachEvent(\"onload\", correctPNG);
</script>
<![endif]-->
<title>My Client Website</title>
<meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\" />
<link href=\"http://www.gov.my/templates/jo_june/css/template_css.css\" rel=\"stylesheet\" type=\"text/css\" />
<link rel=\"shortcut icon\" href=\"http://www.gov.my/templates/jo_june/images/favicon.ico\" />
<link rel=\"shortcut icon\" href=\"http://www.gov.my/images/icon.gif\" /><script type=\"text/javascript\" language=\"javascript\" src=\"http://www.gov.my/templates/jo_june/javascript.js\"></script>
</head><body><div align=\"center\">
<table width=\"820\" height=\"120\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\" >
<tr>
<td height=\"96\" valign=\"top\"><table width=\"856\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\">
<tr>
<th width=\"820\" height=\"80\" align=\"left\" valign=\"middle\" scope=\"col\" class=\"header\">
<table width=\"856\" height=\"175\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">
<tr>
<th scope=\"col\"><div align=\"left\"></div></th>
<th scope=\"col\"><div align=\"right\"> </div></th></tr></table>
</th></tr><tr>
<th width=\"820\" height=\"40\" align=\"left\" valign=\"bottom\" scope=\"row\" class=\"path\"><table width=\"856\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\">
<tr>
<th width=\"320\" align=\"left\" valign=\"middle\" scope=\"col\"><span class=\"pathway\">Laman Utama </span></th>
<th width=\"500\" align=\"left\" valign=\"bottom\" scope=\"col\">
<script type=\"text/javascript\">

one = function() {
var sfEls = document.getElementById(\"top_menu\").getElementsByTagName(\"li\");
for (var i=0; i<sfEls.length; i++) {
sfEls[i].onmouseover=function() {
this.className+=\"one\" }
sfEls[i].onmouseout=function() {
this.className=this.className.replace(new RegExp(\"one\\\\b\"), \"\"); } } }
if (window.attachEvent) window.attachEvent(\"onload\", one);
</script>
<div id=\"top_menu\"><ul id=\"mainlevel-nav\"><li><a href=\"http://www.gov.my/index.php?option=com_contact&Itemid=3\" class=\"mainlevel-nav\" >Content</a></li><li><a href=\"http://www.gov.my/index.php?option=com_content&task=view&id=20&Itemid=31\" class=\"mainlevel-nav\" >Content</a></li><li><a href=\"http://www.gov.my/index.php?option=com_content&task=section&id=1&Itemid=2\" class=\"mainlevel-nav\" >Content</a></li><li><a href=\"http://www.gov.my/index.php\" class=\"mainlevel-nav\" >Content</a></li></ul></div></th>
</tr></table></th></tr></table></td></tr></table>
<table width=\"856\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\" bordercolor=\"#000000\" bgcolor=\"#FFFFFF\">
<tr><td><table width=\"856\" border=\"0\" cellspacing=\"2\" cellpadding=\"0\">
<tr><td width=\"160\" align=\"left\" valign=\"top\"><table cellpadding=\"0\" cellspacing=\"0\" class=\"moduletable\">
<tr><th valign=\"top\">
Content</th></tr><tr><td>
<table width=\"100%\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\">
<tr align=\"left\"><td><a href=\"http://www.gov.my/index.php?option=com_frontpage&Itemid=1\" class=\"mainlevel\" id=\"active_menu\">Content</a></td></tr>
<tr align=\"left\"><td><a href=\"http://www.gov.my/index.php?option=com_content&task=view&id=20&Itemid=31\" class=\"mainlevel\" >Content</a></td></tr>
<tr align=\"left\"><td><a href=\"http://www.gov.my/index.php?option=com_content&task=view&id=16&Itemid=26\" class=\"mainlevel\" >Content</a></td></tr>
<tr align=\"left\"><td><a href=\"http://www.gov.my/index.php?option=com_content&task=section&id=1&Itemid=2\" class=\"mainlevel\" >Content</a></td></tr>
<tr align=\"left\"><td><a href=\"http://www.gov.my/index.php?option=com_content&task=category&sectionid=3&id=7&Itemid=25\" class=\"mainlevel\" >Content</a></td></tr>
<tr align=\"left\"><td><a href=\"http://www.gov.my/index.php?option=com_search&Itemid=5\" class=\"mainlevel\" >Content</a></td></tr>
<tr align=\"left\"><td><a href=\"http://www.gov.my/index.php?option=com_weblinks&Itemid=23\" class=\"mainlevel\" >Content</a></td></tr>
<tr align=\"left\"><td><a href=\"http://www.gov.my/index.php?option=com_contact&Itemid=3\" class=\"mainlevel\" >Content</a></td></tr>
</table> </td></tr></table>
<table cellpadding=\"0\" cellspacing=\"0\" class=\"moduletable\"><tr><td>
<a href=\"index.php?option=com_content&task=view&id=18&Itemid=29\"><img src=\"images/stories/picture.jpg\" border=\"0\" alt=\"messages\" width=\"150\" height=\"65\" /></a>
</td></tr></table><table cellpadding=\"0\" cellspacing=\"0\" class=\"moduletable\">
<tr><td>
<a href=\"https://mail.gov.my/login.php\"><img src=\"images/stories/mail.jpg\" border=\"0\" alt=\"
" width=\"150\" height=\"80\" /></a> </td></tr></table>
<table cellpadding=\"0\" cellspacing=\"0\" class=\"moduletable\"><tr><th valign=\"top\">
Content</th></tr><tr><td>
<a href=\"http://link.gov.my/default.asp\" target=\"_blank\"><div style=\"text-align: center\"><img src=\"images/images/logo.jpg\" border=\"0\" alt=\"Name\" width=\"96\" height=\"115\" /></div></a>
</td></tr></table>
<table cellpadding=\"0\" cellspacing=\"0\" class=\"moduletable\"><tr>
<th valign=\"top\">Content</th></tr><tr><td>
<div class=\"syndicate\"><div align=\"center\">
<a href=\"http://www.gov.my/index.php?option=com_rss&feed=RSS0.91&no_html=1\">
<img src=\"http://www.gov.my/images/M_images/rss091.gif\" alt=\"RSS 0.91\" name=\"RSS091\" align=\"middle\" border=\"0\" /></a>
</div><div align=\"center\">
<a href=\"http://www.gov.my/index.php?option=com_rss&feed=RSS1.0&no_html=1\">
<img src=\"http://www.gov.my/images/M_images/rss10.gif\" alt=\"RSS 1.0\" name=\"RSS10\" align=\"middle\" border=\"0\" /></a>
</div><div align=\"center\">
<div align=\"center\"><a href=\"http://www.gov.my/index.php?option=com_rss&feed=OPML&no_html=1\">
<img src=\"http://www.gov.my/images/M_images/opml.png\" alt=\"OPML\" name=\"OPML\" align=\"middle\" border=\"0\" /></a>
</div></div> </td></tr></table>



So the question now is, How I gonna fix it?

More from Mike, "Nevertheless, a vulnerability clearly exists, and it could be difficult to resolve. Many web sites rely on round robin DNS configurations for load distribution. Since round robin configurations may legitimately return different IP addresses for the same host name, distinguishing malicious DNS rebinding attacks from round robin configurations will be difficult, if not impossible to do." Is that mean my web server is in deep shit?

Several choices can be found through searching on the Vah Vah Vah networks. Disable Javascript would be pain in the ass. Noscript firefox extension can help if not a lot, then a little. Another extension that some people recommends is localrodeo extension that can reduce possibilities for some browser from being exploited for the time being while waiting for another better finalized solutions. Change current DNS nameserver to OpenDNS can help to but obviously not for this kind of problem. Restrict external access to port 80 by means of firewall is also good precaution. But then, no one ever surf the Internet using browser installed within the targeted web server as far as I know which makes the exploits much harder to implement. Is that will make my web server secure?

Continue on the next part cos it's 04:20 a.m. Time to sleep. Need to build printer and file server (Samba) + some printing charging software (GPL of course!) tomorrow as part of charities project for a elementary school that I am working on during free time.

Hey! I listen to:

Update! (15th August 15:19 pm):

www.jumperz.net has released intrusion prevention tool for http/https.
More information can be found here. You will need JDK 1.4
I don't have time yet to test it but soon enough maybe.

Labels:

posted by zarxcky @ 8/07/2007 04:15:00 AM  
10 Comments:
  • At 9/13/2007 3:17 AM, Anonymous Anonymous said…

    I actually admire the guts of Namewee to sing out this Negarakuku. True, the language used is a bit rough but at the end of day it sings out nothing but the truth about how most Chinese Malaysians and the other races see this country. Marginalisation, corruption, civil service bureaucracy, etc.

    If the song is nothing but praises of Malaysia, then it is just another lame song. A lame song that is usually being sung by our Umno to deceive all Malaysians. Is Namewee song seditious? How about the keris waving incident? That was not seditious? Disrespect for Islam just because it was said that some of them were 'out of tune' when praying?

    How about demolishing of those Hindu temples? Isn't that total disrespect for other religions? I hope someone from the ruling parties can enlighten me on these issues.

    If the government intends to strip Namewee of his citizenship, then first strip off the citizenships of Umno members, the arrogant keris waving minister and also those who authorized the demolishing of Hindu temples.

    Until I see that, I don't see any reason why we should strip off the citizenship of a young Malaysian who is frustrated with the way Malaysia turned out after 50 years of independence.

     
  • At 9/13/2007 3:20 AM, Anonymous Anonymous said…

    The truth hurts.

    The Chinese or the yellow race is what brings progress. Just look at Asia……….is enough.

    Whether they do it internationally or locally they will survive.

    We can distinctly see the lowering of Malaysia standards of living as the percentage of Chinese in this country goes down.

    In the 70s we were tops with 40 over percent of Chinese and today with only 25 percent we are far behind Singapore, Hong Kong and Korea.

    Main reason is the number of such Chinese migrating to these countries - the best ones and rich ones.

    Next ten years as the percentage goes even lower, we would be nearing Indonesia or Philippines.

    Meanwhile enjoy your stay and the good time.

    On the whole as the Chinese spreads out throughout the world, the average standards of these will have much higher standards of living over others.

     
  • At 9/13/2007 3:24 AM, Anonymous Anonymous said…

    Merdeka Day is a day of shame especially on this 50th Merdeka Day. On this day you have to compare how a successful country like Singapore has done everything right and why Malaysia has done everything wrong.

    On this day you will wonder why are we not better off if we are still under the British, I can assure you - we do not fall into what we are today. On this day everyone especially Sabah and Sarawak should be reminded that they should not join Malaysia in the first place.

    If you ask me how great are the Umno. I would say they are shameless people just like some Ang Mok who drop their pants for all to see.

     
  • At 9/13/2007 3:28 AM, Anonymous Anonymous said…

    In 1957, Malaysia had the second biggest per capita income after Japan, but now we are at the tail end among the front-rank developed nations in Asia.

    In 2005, Malaysia per capita income increased by only 17 times from 1967, as compared to South Korea which increased 100 times. Hong Kong 40 times, Singapore 45 times and Taiwan 60 times.

    Malaysia is far richer in natural resources than the other countries. Singapore for example has no forest, oil, palm oil, rubber, etc.

    The difference is in the development and utilisation of human resources. Malaysia has failed to make full use of the human resources in the country.

    The statistics indicate that Malaysia was competitive with the other countries up to 1967. Thereafter, the Asian tigers like Hong Kong, Singapore, South Korea and Taiwan leapt forward to lofty heights.

    In 1966, the bumi policy was formally announced as a policy and in 1971, the New Economic Policy was launched. The various measures and regulations from these two policies slowed down economic growth considerably. Traders, businessmen, entrepreneurs, medium and small industries were put off by these policies.

    The reaction of international countries was negative, and many investors shied away from Malaysia. Foreign direct investments declined considerably to US$3.9 billion in 2006, whereas Asean countries had FDI of US$30 billion for Singapore, US$7.9 billion for Thailand, US$10 billion for Vietnam. China had US$70 billion FDI in that year.

    The New Economic Policy which compels reservation of 30% for malays in all economic activities has dampened investment interests of both foreign and local investors.

    With the launching of liberalisation policies in 1978, China leapt forward and it is on the way to become a world economic power by 2030.

    Malaysia too must implement global policies like liberalisation of all economic functions. Bumiputraism and New Economic Policy are the outdated measures, and must be replaced by more enlightened and pragmatic measures.

    If Barisan stubbornly clings to old baggage policies, then it can be predicted that Malaysia per capita income will continue to lag behind the Asian tigers.

     
  • At 9/13/2007 3:31 AM, Anonymous Anonymous said…

    The most popular subject for jokes in Malaysia is the prime minister. That is all that he is good for.

     
  • At 9/13/2007 3:37 AM, Anonymous Anonymous said…

    We are reminding Najib and Mahathir about this, that Malaysia is not an Islamic state and it is not in a social contract.

    Malay Sakai, so please tell Badawi about it. Umno has always threatened the non-malays with riots and chaos. Nobody in Malaysia has started riots and chaos except for Umno.

    Umno has a deep rooted tradition of starting riots and chaos when every time they can't debate sensibly.

    The social contract is there alright and many do not question it. But is the social contract followed according to the spirit or hijacked to the benefit of a few?

    Just look at the number of huge projects that has failed is proof enough. Yet these are treated like normal - part of everyday happening.

    Gosh……….

    All the social contract talk does not hold any water, when you have people in power, namely Umno abusing their power. In fact, they are indirectly telling you, that they have the right to abuse the power. Is this fair? Of course it is unfair. You don't even need a social contract to tell you whether it is fair or not.

    Social contract didn't say that Malaysia is an Islamic state. On the contrary the social contract expressly stated that Malaysia was and is not an Islamic state.

    Now the deliberate misinterpretation, apparently accepted by Umno, is that Malaysia (including Sabah and Sarawak) is an Islamic state!

    Sabah and Sarawak would never have joined Malaysia if they had known that Malaysia will be deemed an Islamic state.

    If the social contract meant that the non-malays would merely exchange the British masters for the malay masters, they would never have agreed to join the malays for independence.

    What is the difference of having the British lording over the non-malays and having the malays doing the same to the non-malays! Probably worse. At least, the British had some respect for fairness while the malays have none!

    So to get independence, the malays needed the non-malays. Without the non-malays agreement, the British would not have granted independence. So, is that not also part of the social contract? It is not a one-sided malay right. The malays would not be where they are without the non-malays.

     
  • At 9/13/2007 3:41 AM, Anonymous Anonymous said…

    When Umno says that you have insulted race and religion and that you are a traitor, then wear it as a badge of honour.

    If Umno fascists and supremacists say that you are a traitor to the cause, then you must have done something right and that you are on the right path.

    You should be really worried if Umno starts praising you and putting you on a lofty pedestal, because it means you have turned your back on everything that is positive, rational and just.

     
  • At 9/13/2007 3:46 AM, Anonymous Anonymous said…

    Sad to say without the Chinese and other non-malay races in Malaysia and Indonesia, the region will be the backwater of Southeast Asia.

    The malays cannot stand on their own feet. Just compare the GDP contribution of non-malays present and past against the malays.

    Sadly, the most Middle Eastern civilization are Islamic based on their God Allah and they are a failure compared to western civilization based on human ideology. This is partially why Malaysia 'tak boleh maju', as its policies are based on religion and race.

    Oh wait, to that malay who says 'majority is always right'. Certainly, you still have a long way to go. You are not 'sons of the soil'. The Orang Asli, not the malays, are the rightful owner of Malaysia.

    You guys stole the land from them, just like your Arab brothers who tried to force their religion on others by military conquest in hopes of dying for your God and copulate with the 72 virgins in Muslim paradise! Cheers.

     
  • At 9/13/2007 3:51 AM, Anonymous Anonymous said…

    Country IQ (2006)

    Hong Kong 108
    Singapore 108
    North Korea 106 (Dictatorial Regime)
    South Korea 106
    Japan 105
    Peoples Republic of China 105 (Communism)
    Republic of China 105
    Italy 102
    Iceland 101
    Mongolia 101

    Very interesting - the entire top 7 slots are occupied by yellow skins.

     
  • At 9/13/2007 3:57 AM, Anonymous Anonymous said…

    The major barrier to Malaysians becoming competitive is our ineffective and outmoded education system.

    Malaysians are fully aware of this, and those who can have already abandoned it. This includes our own minister of education! Witness the steady stream every school day morning of our young heading to Singapore for their education.

    The glaring deficit of our leadership is lack of execution. Your answer to every problem is to form a committee. Punting problems onto committees reflects shallow executive talent. Not paying attention to execution is the bane of many leaders. All your wise policies would be meaningless if their execution is wanting.

    Make Malaysia and Malaysians competitive; that would be a legacy more enduring and worth striving for.

    All these aspirations would be for naught if Malaysians were divided. I am distressed at the deepening polarization of Malaysians and the increasing fragmentation of Malaysians.

    The solution lies not in emphasizing but celebrating our differences; not in minimizing but sharing our commonalities. You must blunt those elements that would drive a wedge between Malaysians, and nurture those that would bring us together.

    Malay leaders are again selling to their followers a bill of goods with the doctrine of Ketuanan Melayu (malay hegemony). These leaders delude themselves and the masses into thinking that we malays have been anointed Tuan (master) of Malaysia, with all the implied glories and privileges.

    Both the premise and promise of Ketuanan Melayu are false. The sooner malays grasp this stark reality, the better it is for us and for all Malaysians, as well as for the nation. In this competitive world, you work to be a master; you must earn it!

    In feudal societies, whether you are fated to be master or servant is determined at birth by your heritage. Malaysia has long passed that stage although many are still entrapped in the feudal mindset.

    The sure path to uniting Malaysians is not through culture, education, language, politics, or religion but economics, specifically through the wonders of the marketplace.

    Embrace free enterprise, and encourage the market exchange of goods and services among Malaysians, and between Malaysians and the world.

    Once Malaysians view each other less as malays and non-malays but more as potential clients, customers and partners, national unity and prosperity would be enhanced. Likewise when we view foreigners in those terms, Malaysians would be contributing their share towards world peace and prosperity.

    Build on our own legacy, and if you are successful, the excesses of you predecessor will become obvious through comparison. Create your legacy in your own style. There is no need to blow out someone else's candle in order to make yours shine brighter.

     
Post a Comment
<< Home
 
About Me
Previous Post
Archives
Links
Comrades
Syndicates