DNS/ManagedDNS/awsdns/Darkreading/

1. blackhat/slide

https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-A-New-Class-Of-DNS-Vulnerabilities-Affecting-Many-DNS-As-Service-Platforms.pdf

DNS is incredibly complex

Dynamic DNS DNS/RFC/2136

1.1. Dynamic DNS: Finding the Master

▪ Microsoft has its own algorithm ▪ It does not work exactly as the RFC defines

Finding the Master (Private network -> Internal Resolver

• Dynamic update SOA wiz.io [success!] --> Internal Master

#21

Finding the Master (External Network --> External Resolver

• Dynamic update SOA wiz.io [Fail!] --> Amazon's Route53 Name server

  • A query for ns-1611.awsdns-09.co.uk >> poison response

ここの動作に問題がある。(リゾルバーではなく、権威サーバーで説明可能だった。) -- ToshinoriMaeno 2021-08-10 07:00:43)

• どこに問い合わせているのか。Amazon's Route53 Name server とはなにか。(権威サーバー)

リゾルバーが関係しているかと思ったが、必要なかった。

Windows Dynamic Updateの動作がおかしい。そこに付け込む余地を与えたのがawsdnsだ。

• wiz.io blog から。

Eventually, the endpoint will try to update the master server, 
which is an AWS shared server that manages thousands of customers. 

AWS name servers do not support dynamic DNS updates, so the update request will fail. 
So far the Microsoft algorithm works exactly as expected, 
and at this point it should stop and give up on updating the master server.

But that’s not what happens – and here’s where the problem arises. 
Instead of giving up, Microsoft's tries to find the master DNS server in another way.

The next step will be to check if Wiz’s name servers have records for the master server.

AWS’s name server responds with the IP address we’ve provided, in this case 1.3.3.7. 
This is where the Windows endpoint will send the dynamic update...inadvertently leaking it’s internal IP address, computer name, and other info to our malicious DNS server. 

https://twitter.com/beyondDNS/status/1423892844670951425?s=20

動作がおかしいAmazon's Route 53 Nameserver とはなにか。

awsdns向けに用意されたリゾルバーなのか。もしそうだったら、もっと危ないことも起きそうだ。 午後3:24 · 2021年8月7日·

Dynamic DNS:

• So what did we learn so far?

@ShirTamari @AmiLuttwak @Wiz_io #BHUSA @BlackHatEvents

• Windows endpoints use a custom algorithm to find the master DNS
• The algorithm queries the nameserver for its own address
• The result: Our malicious DNS server receives Dynamic DNS traffic from millions of endpoints