Exploit Code for Kaminsky DNS Bug Goes Wild Page 2 - dslreports.com

			Search:
	login · register

	All Forums		Hot Topics		Gallery

how-to block ads

Forums » Up and Running » Security » Security » Exploit Code for Kaminsky DNS Bug Goes Wild


Search Topic:	Uniqs: 4277	Share Topic:	RSS topic:	toggle: flat / full normal / watch	Posting:	Post a:	Post a:

Links: ·Hijack This logs? ·Panda Free Tools ·Vundo Removal

Affected by DNS poisoning? » « SuperSick2008
page: 1 · 2 · 3

Author

All Replies

NetFixer
Freedom is NOT Free
Premium
join:2004-06-24
Murfreesboro, TN

·AT&T Southeast

·Cingular Wireless

·AT&T CallVantage

reply to Traxless
Re: Exploit Code for Kaminsky DNS Bug Goes Wild

said by Traxless

:

Last night, my AT&T DNS (DFW, Texas) did not pass the test at »https://www.dns-oarc.net/oarc/services/dnsentropy. Early this morning, the same DNS addresses passed with a great rating. Something changed during the last 6 hours!

Glad to hear that AT&T is slowly making progress. My latest tests with the AT&T SE servers as well as their global AnyCast servers indicate that those servers still have no random port capabilities. Considering that AT&T has had a few DNS server disasters in the past, you can understand why they are taking this slow incremental approach.
--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.
Test your firewall.

to forum · permalink ·

· 2008-07-25 02:16:41 ·

Libra
Premium
join:2003-08-06
USA

reply to NetFixer
Hi NetFixer!
Thank you so very much. I followed your advice regarding the modem and now both computers come up with Great! I appreciate your explaining to me what the zeros meant and how to undo my change if it didn't work.

I was very worried about this vulnerability and appreciate your help very much.

Sincerely, Libra

to forum · permalink ·

· 2008-07-25 02:16:47 ·

FiOS Dan
Premium
join:2001-07-06
Redondo Beach, CA

reply to NetFixer
Re: Exploit code for Kaminsky DNS Bug Goes Wild

Thanks for the reply NetFixer. What I was referring to is the case where a road warrior's internet access is via a hotel or airport WiFi whose router DNS settings would override his or her laptop's. Is this not the case?
--
Courage is being scared to death but saddling up anyway.

to forum · permalink ·

· 2008-07-25 11:21:45 ·

scelli
Native New Yorker
Premium
join:1999-08-07
USA

reply to Traxless
Re: Exploit Code for Kaminsky DNS Bug Goes Wild

said by Traxless

:

Last night, my AT&T DNS (DFW, Texas) did not pass the test at »https://www.dns-oarc.net/oarc/services/dnsentropy. Early this morning, the same DNS addresses passed with a great rating. Something changed during the last 6 hours!

Keep checking periodically. I've used the test a number of times in the last 48 hours and sometimes come up with a GREAT mark, sometimes with a POOR mark and sometimes a combo of both.

Who ever really knows with Ma Bell? BTW: I've had AT&T and have always had them all the way back to January of 1997 when the company was Southwestern Bell Internet Services.
--
The maximum effective range of an excuse is ZERO meters!

to forum · permalink ·

· 2008-07-25 11:46:59 ·

NetFixer
Freedom is NOT Free
Premium
join:2004-06-24
Murfreesboro, TN

·AT&T Southeast

·Cingular Wireless

·AT&T CallVantage

reply to FiOS Dan
Re: Exploit code for Kaminsky DNS Bug Goes Wild

said by FiOS Dan

:

Thanks for the reply NetFixer. What I was referring to is the case where a road warrior's internet access is via a hotel or airport WiFi whose router DNS settings would override his or her laptop's. Is this not the case?

No, If you manually enter the DNS servers in the TCPIP properties for the WiFi card, that is what will be used. I showed a picture of my desktop PC's NIC, but the same setup and principle would apply for a WiFi card. Here are sample ipconfig /all and nslookup www.yahoo.com commands for several different scenarios that I just made from a foreign WiFi connection to illustrate my point:

This is using the default settings for a foreign WiFi connection:
(in this case it is safe because Comcast has updated their DNS, but of course, that would not always be the case)

C:\>ipconfig /all


Windows IP Configuration

        Host Name . . . . . . . . . . . . : RWS-6325
        Primary Dns Suffix  . . . . . . . : dcs-net.net
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : dcs-net
                                            dcs-net.net

Ethernet adapter Local Area Connection 2:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Bluetooth PAN Network Adapter
        Physical Address. . . . . . . . . : 00-11-E0-02-F6-D6

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
        Physical Address. . . . . . . . . : 00-17-A4-E3-E7-CF

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . : hsd1.tn.comcast.net.
        Description . . . . . . . . . . . : Broadcom 802.11b/g WLAN
        Physical Address. . . . . . . . . : 00-1A-73-67-2C-DC
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.104
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 68.87.68.162
                                            68.87.74.162
                                            68.87.64.196
        Lease Obtained. . . . . . . . . . : Friday, July 25, 2008 10:31:56
        Lease Expires . . . . . . . . . . : Saturday, July 26, 2008 10:31:56

C:\>nslookup www.yahoo.com
Server: cns.s3woodstock.ga.atlanta.comcast.net
Address: 68.87.68.162

Non-authoritative answer:
Name: www.yahoo-ht3.akadns.net
Address: 69.147.76.15
Aliases: www.yahoo.com

*** You will note that in this case the WiFi connection's DNS was used. ***

This is using a manually entered known good set of public DNS servers:

C:\>ipconfig /all


Windows IP Configuration

        Host Name . . . . . . . . . . . . : RWS-6325
        Primary Dns Suffix  . . . . . . . : dcs-net.net
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : dcs-net
                                            dcs-net.net

Ethernet adapter Local Area Connection 2:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Bluetooth PAN Network Adapter
        Physical Address. . . . . . . . . : 00-11-E0-02-F6-D6

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
        Physical Address. . . . . . . . . : 00-17-A4-E3-E7-CF

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . : hsd1.tn.comcast.net.
        Description . . . . . . . . . . . : Broadcom 802.11b/g WLAN
        Physical Address. . . . . . . . . : 00-1A-73-67-2C-DC
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.104
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 4.2.2.4
                                            4.2.2.6
        Lease Obtained. . . . . . . . . . : Friday, July 25, 2008 10:39:15
        Lease Expires . . . . . . . . . . : Saturday, July 26, 2008 10:39:15

C:\>nslookup www.yahoo.com
Server: vnsc-pri-dsl.genuity.net
Address: 4.2.2.4

Non-authoritative answer:
Name: www.yahoo-ht3.akadns.net
Address: 69.147.76.15
Aliases: www.yahoo.com

*** You will note that in this case the manually entered public DNS was used. ***

This is using the manually entered company's publicly visible DNS servers:

C:\>ipconfig /all


Windows IP Configuration

        Host Name . . . . . . . . . . . . : RWS-6325
        Primary Dns Suffix  . . . . . . . : dcs-net.net
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : dcs-net
                                            dcs-net.net

Ethernet adapter Local Area Connection 2:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Bluetooth PAN Network Adapter
        Physical Address. . . . . . . . . : 00-11-E0-02-F6-D6

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
        Physical Address. . . . . . . . . : 00-17-A4-E3-E7-CF

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . : hsd1.tn.comcast.net.
        Description . . . . . . . . . . . : Broadcom 802.11b/g WLAN
        Physical Address. . . . . . . . . : 00-1A-73-67-2C-DC
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.104
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 66.134.0.234
                                            74.245.184.227
        Lease Obtained. . . . . . . . . . : Friday, July 25, 2008 11:11:09
        Lease Expires . . . . . . . . . . : Saturday, July 26, 2008 11:11:09

C:\>nslookup www.yahoo.com
Server: dcs-net.net
Address: 66.134.0.234

Non-authoritative answer:
Name: www.yahoo-ht3.akadns.net
Address: 69.147.76.15
Aliases: www.yahoo.com

*** You will note that in this case the manually entered company DNS was used. ***

This is using a PPTP VPN connection to the company network:

C:\>ipconfig /all


Windows IP Configuration

        Host Name . . . . . . . . . . . . : RWS-6325
        Primary Dns Suffix  . . . . . . . : dcs-net.net
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : dcs-net
                                            dcs-net.net

Ethernet adapter Local Area Connection 2:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Bluetooth PAN Network Adapter
        Physical Address. . . . . . . . . : 00-11-E0-02-F6-D6

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
        Physical Address. . . . . . . . . : 00-17-A4-E3-E7-CF

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . : hsd1.tn.comcast.net.
        Description . . . . . . . . . . . : Broadcom 802.11b/g WLAN
        Physical Address. . . . . . . . . : 00-1A-73-67-2C-DC
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.104
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 68.87.68.162
                                            68.87.74.162
                                            68.87.64.196
        Lease Obtained. . . . . . . . . . : Friday, July 25, 2008 10:46:58
        Lease Expires . . . . . . . . . . : Saturday, July 26, 2008 10:46:58

PPP adapter DCS Enterprises:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
        Physical Address. . . . . . . . . : 00-53-45-00-00-00
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.10.201
        Subnet Mask . . . . . . . . . . . : 255.255.255.255
        Default Gateway . . . . . . . . . : 192.168.10.201
        DNS Servers . . . . . . . . . . . : 192.168.10.1

C:\>nslookup www.yahoo.com
*** Can't find server name for address 68.87.68.162: Query refused
*** Can't find server name for address 68.87.74.162: Query refused
*** Can't find server name for address 68.87.64.196: Query refused
Server: dcs-gw1.dcs-net
Address: 192.168.10.1

Non-authoritative answer:
Name: www.yahoo-ht3.akadns.net
Address: 69.147.76.15
Aliases: www.yahoo.com

*** You will note that even though the notebook attempted to use the WiFi connection's DNS first, the company's firewall prevented access and used its own DNS. ***

This is using an IPSEC VPN connection to company network:

C:\>ipconfig /all


Windows IP Configuration

        Host Name . . . . . . . . . . . . : RWS-6325
        Primary Dns Suffix  . . . . . . . : dcs-net.net
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : dcs-net
                                            dcs-net.net

Ethernet adapter Local Area Connection 2:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Bluetooth PAN Network Adapter
        Physical Address. . . . . . . . . : 00-11-E0-02-F6-D6

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
        Physical Address. . . . . . . . . : 00-17-A4-E3-E7-CF

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . : hsd1.tn.comcast.net.
        Description . . . . . . . . . . . : Broadcom 802.11b/g WLAN
        Physical Address. . . . . . . . . : 00-1A-73-67-2C-DC
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.1.104
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.1.1
        DHCP Server . . . . . . . . . . . : 192.168.1.1
        DNS Servers . . . . . . . . . . . : 192.168.10.1
                                            68.87.68.162
                                            68.87.74.162
                                            68.87.64.196
        Lease Obtained. . . . . . . . . . : Friday, July 25, 2008 10:55:11
        Lease Expires . . . . . . . . . . : Saturday, July 26, 2008 10:55:11

C:\>nslookup www.yahoo.com
Server: dcs-gw1.dcs-net
Address: 192.168.10.1

Non-authoritative answer:
Name: www.yahoo-ht3.akadns.net
Address: 69.147.76.15
Aliases: www.yahoo.com

*** You will note that in this case the company's DNS was used first, so the WiFi connection's DNS did not come into play. ***

There is almost always more than one way to accomplish the same task; in this case, ensuring a safe DNS source even when on the road.

As a control sample, this is what a WiFi connection to my office LAN looks like:

C:\>ipconfig /all


Windows IP Configuration

        Host Name . . . . . . . . . . . . : RWS-6325
        Primary Dns Suffix  . . . . . . . : dcs-net.net
        Node Type . . . . . . . . . . . . : Hybrid
        IP Routing Enabled. . . . . . . . : No
        WINS Proxy Enabled. . . . . . . . : No
        DNS Suffix Search List. . . . . . : dcs-net
                                            dcs-net.net

Ethernet adapter Local Area Connection 2:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Bluetooth PAN Network Adapter
        Physical Address. . . . . . . . . : 00-11-E0-02-F6-D6

Ethernet adapter Local Area Connection:

        Media State . . . . . . . . . . . : Media disconnected
        Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
        Physical Address. . . . . . . . . : 00-17-A4-E3-E7-CF

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . : dcs-net
        Description . . . . . . . . . . . : Broadcom 802.11b/g WLAN
        Physical Address. . . . . . . . . : 00-1A-73-67-2C-DC
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 192.168.10.68
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . : 192.168.10.1
        DHCP Server . . . . . . . . . . . : 192.168.10.1
        DNS Servers . . . . . . . . . . . : 192.168.10.2
                                            192.168.10.1
        Primary WINS Server . . . . . . . : 192.168.10.2
        Lease Obtained. . . . . . . . . . : Friday, July 25, 2008 11:28:15
        Lease Expires . . . . . . . . . . : Monday, July 28, 2008 11:28:15

C:\>nslookup www.yahoo.com
Server: dcs-srv.dcs-net.net
Address: 192.168.10.2

Non-authoritative answer:
Name: www.yahoo-ht3.akadns.net
Address: 69.147.76.15
Aliases: www.yahoo.com

--
We can never have enough of nature.
We need to wit ness our own limits transgressed, and some life pasturing freely where we never wander.Test your firewall.

to forum · permalink ·

· 2008-07-25 12:49:06 ·

sivran
Long Live The Suite
Premium
join:2003-09-15
Arlington, TX
clubs:

·RoadRunner Cable

reply to SUMware
Re: Exploit Code for Kaminsky DNS Bug Goes Wild

Please note the Level3 4.2.2.1-6 IPs are anycast, and will point to the nearest Level3 DNS server to you which may or may not be patched. NetFixer and others posted showing patched Level3 servers long before my local ones were.

If you put one or two of them in, check them. If unsafe switch to OpenDNS for a few days.
--
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon profitable cause...

to forum · permalink ·

· 2008-07-25 13:28:50 ·

swhx7
Premium
join:2006-07-23
Elbonia

·RoadRunner Cable

reply to SUMware
Can one of the gurus clarify how vulnerable clients are?

The discussion on www has mostly been about DNS servers, but the original notices said to patch clients too. There are patches for popular OS's, but routers rewrite ports as mentioned in another thread, and some of the routers are not patchable. Assuming the DNS servers are good, is the client then OK? It seems that an attack would still be possible by spamming bogus replies to a client behind an unpatched NAT device.

to forum · permalink ·

· 2008-07-25 13:32:30 ·

NetFixer
Freedom is NOT Free
Premium
join:2004-06-24
Murfreesboro, TN

·AT&T Southeast

·Cingular Wireless

·AT&T CallVantage

reply to sivran

said by sivran

:

Please note the Level3 4.2.2.1-6 IPs are anycast, and will point to the nearest Level3 DNS server to you which may or may not be patched.

Good point, and one I overlooked when recommending them as an alternative DNS source. That possibly explains why some posters are showing AT&T servers as patched and others are not since some of the AT&T servers are also AnyCast.
--
We can never have enough of nature.
We need to witness our own limits transgressed, and some life pasturing freely where we never wander.
Test your firewall.

to forum · permalink ·

· 2008-07-25 13:33:26 ·

FiOS Dan
Premium
join:2001-07-06
Redondo Beach, CA

reply to NetFixer
Re: Exploit code for Kaminsky DNS Bug Goes Wild

Very informative NetFixer. I will manually enter the OpenDNS servers in my laptop's setting. Thanks a lot.
--
Courage is being scared to death but saddling up anyway.

to forum · permalink ·

· 2008-07-25 13:44:10 ·

spy1
Welcome to Amerika
Premium
join:2002-06-24
Charlotte, NC

reply to SUMware
Thanks for the reminder about OpenDNS. I had thought that I was already using it (I was on the router before this upgraded, faster one from my ISP) - but after reading this I checked it just to be on the safe side and sure enough, I wasn't.

Went to both websites mentioned and found out that my ISP's DNS' failed. Re-set up OpenDNS and everything came out great.

Thanks. Pete

to forum · permalink ·

· 2008-07-25 17:32:09 ·

norwegian
Premium
join:2005-02-15
Outback

·WestNet Broadband

reply to swhx7
Re: Exploit Code for Kaminsky DNS Bug Goes Wild

said by swhx7

:

The discussion on www has mostly been about DNS servers, but the original notices said to patch clients too. There are patches for popular OS's, but routers rewrite ports as mentioned in another thread, and some of the routers are not patchable. Assuming the DNS servers are good, is the client then OK? It seems that an attack would still be possible by spamming bogus replies to a client behind an unpatched NAT device.

Yes would like this clarified. It is mentioned "every level" is affected by this.

Where is the support for routers? Will having the router act as a DNS server become a problem? According to the test, my ISP's DNS test's are clear, my O/S is patched.
There is a little mention on approach at one of your best sources but looking at that list doesn't give any confidence. Will simply not having a default password be enough? Or is the level lower down the chain and, yes it is a risk, and a new router/firmware is required?

A little was discussed briefly here
--
The only thing necessary for the triumph of evil is for good men to do nothing - Edmund Burke

to forum · permalink ·

· 2008-07-25 21:50:37 ·

SUMware
Premium
join:2002-05-21

reply to SUMware
First DNS attacks reported

From VNUnet
26 Jul 2008 -

quote:
The first attacks to on the Kaminsky DNS vulnerability have been reported.

The attack was reported by a user named James Kosin to a Fedora Linux mailing list. Kosin posted a log which he said was gathered Thursday night. The attacker attempts to access the server's cache for entries to such sites as myspace, ebay and Wachovia.

to forum · permalink ·

· 2008-07-25 22:22:49 ·

timcuth
Braves Fan
Premium
join:2000-09-18
Pelham, AL
clubs:

·AT&T Southeast

reply to SUMware
Re: Exploit Code for Kaminsky DNS Bug Goes Wild

Until I went through this thread, I was using TreeWalk DNS and 127.0.0.1 as my primary DNS. I perceive this as "not safe" under the new threats so, after absorbing the info in this thread, I tried the recommended tests.

I am puzzled, because they both detected my static WAN IP address as my DNS server and determined it to be unsafe.

Anyway, I switched to OpenDNS as promary and secondary in both my PC TCP/IP protocol and my router's DNS setup. Now, both test sites deem my setup to be safe. I also registered at OpenDNS, but I'm unsure about dealing with all the custom settings. I changed a few of them that I feel comfortable with.

So, since my router now uses OpenDNS, do I need to update the TCP/IP config on the rest of the PC's in my home?

Tim
--
"Life is like this long line, except at the end there ain't no merry-go-round." - Arthur on The King of Queens
~ Project Hope ~

to forum · permalink ·

· 2008-07-26 09:56:50 ·

spy1
Welcome to Amerika
Premium
join:2002-06-24
Charlotte, NC

I don't know if it really answers your question or not, but after I switched my router to OpenDNS, I checked my wifes' computer (connected by a LinkSys wireless card) at both links and it passed, too, without my having to do anything further.

Pete

to forum · permalink ·

· 2008-07-26 11:55:07 ·

FiOS Dan
Premium
join:2001-07-06
Redondo Beach, CA

reply to timcuth

said by timcuth

:

So, since my router now uses OpenDNS, do I need to update the TCP/IP config on the rest of the PC's in my home?

Based upon the knowledgeable feedback I have received here at BBR the past couple of weeks timcuth I would say that your router settings trump the TCP/IP config in your PCs, so just set the latter to automatic.
--
Courage is being scared to death but saddling up anyway.

to forum · permalink ·

· 2008-07-26 12:02:58 ·

TheWiseGuy
Dog And Butterfly
Premium,MVM
join:2002-07-04
Yonkers, NY

reply to timcuth

said by timcuth

:

Until I went through this thread, I was using TreeWalk DNS and 127.0.0.1 as my primary DNS. I perceive this as "not safe" under the new threats so, after absorbing the info in this thread, I tried the recommended tests.

I am puzzled, because they both detected my static WAN IP address as my DNS server and determined it to be unsafe.

Treewalk was acting as the server and actually doing the lookups.

said by timcuth

:

So, since my router now uses OpenDNS, do I need to update the TCP/IP config on the rest of the PC's in my home?

Tim

It depends on whether you have entered DNS servers, in the past, into the network configuration for those computers. If you have them set to obtain the DNS servers via DHCP then the computers are simply asking the router for the DNS servers and you are fine.

On a computer you either set the DNS server IPs manually, or you tell it to obtain them via DHCP. If you have set the IPs in the computer manually the computer will use the IPs you have set manually as the servers.

If you tell it to obtain them via DHCP, depending on the router, the router may pass the IP of the router or the IPs it has as DNS servers. (What those IPs are follows the same logic as with the computer, they can be set manually or obtained via DHCP.) As long as the computer is set to obtain DNS servers via DHCP then the computer will end up using the servers in the router.
--
Warning, If you post nonsense and use misinformation and are here to argue based on those methods, you will be put on ignore.

to forum · permalink ·

· 2008-07-26 12:20:35 ·

timcuth
Braves Fan
Premium
join:2000-09-18
Pelham, AL
clubs:

reply to SUMware
Ok, I think I've got it. Thanks.

Tim

to forum · permalink ·

· 2008-07-26 12:39:50 ·

KC_User

@swbell.net

reply to SUMware
I made a batch file to switch the DNS servers over for the command prompt junky, as I am. Natually, use at your OWN RISK. OS: Win XP (sp-2), dns is hardcoded into the network settings, not obtained through DHCP. The batch file, as written, depends on the connection being named "Local Area Connection". In the file, I call certain DNS servers "gte" that I've seen referred to in this thread as "Level3".

Naturally, the batch file can be modified, and the underlying command, netsh, in combination with a batch file, can be used to script complete configuration of a network connection. In this case, this file deals with DNS only.

The file will have to be changed from .txt to .bat and in the path of your command prompt. My commmand prompt opens in the directory where my batch files are located.

to forum · permalink · 2008-07-26 13:22:55 ·

KC_User

@swbell.net

ipdns.txt 2,986 bytes

Me thinks I posted too soon. I made changes to the file, added servers, and it seems to work fine on my XP machine. When a change is made, it takes effect at once, so I can click retest on the dns-oarc.net to see the changes. Should be useful for someone wanting to test a series of DNS servers for this vulnerability.

to forum · permalink · 2008-07-26 15:09:33 ·

caffeinator
Coming soon to a cup near you..
Premium
join:2005-01-16
Spokane, WA

reply to FiOS Dan
That's how my setup works, and so far so good.

OT, but perhaps not..I noticed there were several updates for IPcop recently too.

to forum · permalink ·

· 2008-07-26 16:16:12 ·

-

Topic: Follow · Sitemark · Mark Unread

Forums » Up and Running » Security » Security	Affected by DNS poisoning? » « SuperSick2008
page: 1 · 2 · 3


Saturday, 28-Nov 06:43:58	Terms of Use \| Privacy Policy \| Hosting by www.nac.net - DSL,Hosting & Co-lo \| feedback \| contact over 10 years online! © 1999-2009 dslreports.com.republican-creole page compression OFF

Most commented news this week
· [121] Time Warner Cable Fires Broadside At Broadcasters
· [112] New AT&T Ad Campaign Hits Back At Verizon
· [96] Apple Joins AT&T Verizon Snark Fest
· [87] New Bill Takes Aim At Higher Verizon ETFs
· [71] TiVo Sees Record Customer Losses
· [69] In-Flight Internet Headed For Bumpy Landing?
· [66] Verizon CEO: Hulu Will Be Dead Soon
· [62] Thanksgiving Open Thread
· [50] Weekend Open Thread
· [40] EFF Wages War On Fine Print

Most people now reading
· Windows 7 boot manager editing questions [Microsoft Help]
· [Newsgroups] Newzleech down? [Filesharing Software]
· What is the spell hit cap for a lvl 80 full arcane spec mage [World of Warcraft]
· 3.x Feral Druid - Bear Tanking Guide [World of Warcraft]
· HOW-TO: QoS and Tomato (fixes "choppy voice") [MagicJack]
· [ PVP] 3.2 DK PvP D/W Spec... [World of Warcraft]
· Not strictly "Home" related - but WOW anyways... [Home Repair & Improvement]
· Backstab vs screws (not which to use) [Home Repair & Improvement]
· pfSense vs IPCop vs Zeroshell vs Monowall vs Tomato [TekSavvy]
· [Config] cisco asa 5505 with multiple outside IP addresses [Cisco]