The use of self-reported DNS names as authentication is flawed
and can easily be spoofed by malicious users.
Time of Introduction
Architecture and Design
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Authentication
Malicious users can fake authentication information by providing false
DNS information.
Likelihood of Exploit
High
Demonstrative Examples
Example 1
The following code uses a DNS lookup to determine whether or not an
inbound request is from a trusted host. If an attacker can poison the DNS
cache, they can gain trusted status.
(Bad Code)
C
struct hostent *hp;struct in_addr myaddr;
char* tHost = "trustme.example.com";
myaddr.s_addr=inet_addr(ip_addr_string);
hp = gethostbyaddr((char *) &myaddr, sizeof(struct
in_addr), AF_INET);
if (hp && !strncmp(hp->h_name, tHost,
sizeof(tHost))) {
VOIP product allows authentication bypass using
127.0.0.1 in the Host header.
Potential Mitigations
Phase
Description
Architecture and Design
Use other means of identity verification that cannot be simply
spoofed. Possibilities include a username/password or
certificate.
Other Notes
As DNS names can be easily spoofed or misreported, they do not constitute
a valid authentication mechanism. Alternate methods should be used if the
significant authentication is necessary. In addition, DNS name resolution as
authentication would -- even if it was a valid means of authentication --
imply a trust relationship with the DNS servers used, as well as all of the
servers they refer to.
IP addresses are more reliable than DNS names, but they can also be
spoofed. Attackers can easily forge the source IP address of the packets
they send, but response packets will return to the forged IP address. To see
the response packets, the attacker has to sniff the traffic between the
victim machine and the forged IP address. In order to accomplish the
required sniffing, attackers typically attempt to locate themselves on the
same subnet as the victim machine. Attackers may be able to circumvent this
requirement by using source routing, but source routing is disabled across
much of the Internet today. In summary, IP address verification can be a
useful part of an authentication scheme, but it should not be the single
factor required for authentication.
Description
