DNS/ManagedDNS/awsdns/Darkreading/

1. blackhat/slide

https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-A-New-Class-Of-DNS-Vulnerabilities-Affecting-Many-DNS-As-Service-Platforms.pdf

DNS is incredibly complex

Dynamic DNS DNS/RFC/2136


1.1. Dynamic DNS: Finding the Master

▪ Microsoft has its own algorithm ▪ It does not work exactly as the RFC defines


Finding the Master (Private network -> Internal Resolver


#21

Finding the Master (External Network --> External Resolver

ここの動作に問題がある。(リゾルバーではなく、権威サーバーで説明可能だった。) -- ToshinoriMaeno 2021-08-10 07:00:43)

リゾルバーが関係しているかと思ったが、必要なかった。

Windows Dynamic Updateの動作がおかしい。そこに付け込む余地を与えたのがawsdnsだ。

Eventually, the endpoint will try to update the master server, 
which is an AWS shared server that manages thousands of customers. 

AWS name servers do not support dynamic DNS updates, so the update request will fail. 
So far the Microsoft algorithm works exactly as expected, 
and at this point it should stop and give up on updating the master server.

But that’s not what happens – and here’s where the problem arises. 
Instead of giving up, Microsoft's tries to find the master DNS server in another way.

The next step will be to check if Wiz’s name servers have records for the master server.

AWS’s name server responds with the IP address we’ve provided, in this case 1.3.3.7. 
This is where the Windows endpoint will send the dynamic update...inadvertently leaking it’s internal IP address, computer name, and other info to our malicious DNS server. 

https://twitter.com/beyondDNS/status/1423892844670951425?s=20

動作がおかしいAmazon's Route 53 Nameserver とはなにか。

awsdns向けに用意されたリゾルバーなのか。もしそうだったら、もっと危ないことも起きそうだ。 午後3:24 · 2021年8月7日·


Dynamic DNS:

@ShirTamari @AmiLuttwak @Wiz_io #BHUSA @BlackHatEvents

MoinQ: DNS/ManagedDNS/awsdns/Darkreading/blackhat/slide (last edited 2021-08-10 10:57:39 by ToshinoriMaeno)