home.social

#keytrap — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #keytrap, aggregated by home.social.

fetched live
  1. Stéphane Bortzmeyer @[email protected] ·

    Proposal to add hard numerical limits to the #DNS parameters, in order to limit DoS attacks like #KeyTrap, Infinite or #Tsuname

    For instance, max. number of NS records : 13, max. number of DNSSEC keys: 6, max. length of the CNAME chain: 1 (3 for the sissies), etc.

    #IETF121

    @x_cli

    #dns #keytrap #tsuname #ietf121
  2. Adrian Offerman @[email protected] ·

    op SIDN.nl: Alle DNS-software en -diensten bleken kwetsbaar voor DoS-aanval -- 25 jaar oude kwetsbaarheid in DNSSEC-ontwerp afgelopen weken gepatcht
    sidn.nl/nieuws-en-blogs/alle-d

    "De kwetsbaarheid met de naam #KeyTrap maakte het mogelijk om vanaf een DNS-server een Denial-of-Service (DoS)-aanval uit te voeren op een validerende resolver. Omdat het een probleem in de specificatie zelf betrof, waren alle veelgebruikte DNS-resolvers en -diensten aangedaan."

    #DNSSEC #InternetSecurity

    #keytrap #dnssec #internetsecurity
  3. Stéphane Bortzmeyer @[email protected] ·

    Le 16 février a été publiée la faille de sécurité #DNSSEC #KeyTrap Je sais, c'est un peu tard pour en parler mais c'est quand même utile, non ?

    bortzmeyer.org/keytrap.html

    #dnssec #keytrap
  4. Stéphane Bortzmeyer @[email protected] ·

    Very good analogy by Edward Lewis on an #IETF mailing list (in the context of #KeyTrap) about the risk of filtering stuff in the name of security: filtering can also clog the system. "I am picturing a screen put over a water spillway, or paper air
    filters in an HVAC intake or internal combustion engines." "Filtering will slow flow and may even entirely stop it"

    #ietf #keytrap
  5. Stéphane Bortzmeyer @[email protected] ·

    @dad Ah, j'avais prévu d'écrire un article sur #KeyTrap en français mais j'ai eu la flemme. Ceci dit, il n'est pas trop tard.

    #keytrap
  6. Stéphane Bortzmeyer @[email protected] ·

    Si vous ne savez pas quoi lire ce week-end, que vous vous intéressez au #DNS, et que vous n'avez pas encore lu l'article sur #KeyTrap, il est bien. Il faut juste ignorer les phrases du genre « Solving these issues fundamentally requires to
    reconsider the basics of the design philosophy of the Internet. » et autres exagérations typiques d'Haya Shulman. athene-center.de/en/keytrap

    (Avant, pensez à mettre à jour vos résolveurs.)

    #dns #keytrap
  7. Royce Williams @[email protected] ·

    Looks like @sans_isc picked up on an exploit for KeyTrap - I haven't tested it yet, and it is explicitly documented as being defanged, but looks legit on the surface:

    github.com/knqyf263/CVE-2023-5

    Added to my roll-up post.

    #keytrap #nsec3 #CVE202350387 #CVE_2023_50387
    #dns #dnssec

    #keytrap #nsec3 #cve202350387 #cve_2023_50387 #dns #dnssec
  8. ricardo :mastodon: @governa ·

    attack: Internet access disrupted with one packet

    bleepingcomputer.com/news/secu

    #keytrap #dns
  9. Marcel SIneM(S)US @[email protected] ·

    #DNS-Server: #Bind, #dnsmasq und #Unbound stolpern über Sicherheitslücke "#KeyTrap" | Security heise.de/news/DNS-Server-Bind- #Patchday #DNSSEC

    #dns #bind #dnsmasq #unbound #keytrap #patchday
  10. Jan Schaumann @[email protected] ·

    You may have seen talk of the "#KeyTrap" #DNSSEC vulnerability in the last few days, with patches pushed for e.g., bind, unbound, knot, etc. in a well coordinated effort across the #DNS community and industry.

    In a nutshell: you could DoS a validating resolver by causing it to perform excessive expensive signature validations.

    The research team has now published the technical paper:
    athene-center.de/fileadmin/con

    ISC has a good summary here:
    isc.org/blogs/2024-bind-securi

    #dns #dnssec #keytrap
  11. deltatux :donor: @[email protected] ·

    Researchers from the National Research Center for Applied Cybersecurity in Germany have disclosed a critical flaw in the way DNSSEC was designed and dubbed it "KeyTrap".

    Essentially, the "KeyTrap" flaw allows an attacker to use a specially crafted DNS packet to cause a denial-of-service on the targeted DNSSEC-validating DNS server.

    Since the flaw exists in the DNSSEC standard itself, it affects all major DNS server implementations like BIND9, Unbound, Microsoft DNS and etc. All public resolvers like Google DNS and Cloudflare DNS are also affected.

    For more:     www.athene-center.de/en/news/press/key-trap & infosec.exchange/@tychotithonus/111924626712765292

    #infosec #cybersecurity #dnssec #DNS #KeyTrap #DoS #DenialofService

    #infosec #cybersecurity #dnssec #dns #keytrap #dos
  12. Petr Menšík :fedora: @pemensik ·

    My Valentine day gift were a lot of work related to new vulnerability. Delivered one evening in advance, but quite a gift. Sorry, no time for today because cannot wait. 😳😘

    #dnssec #keytrap #love #work
  13. 🛡 [email protected]/:~# :blinking_cursor:​ @[email protected] ·

    "🔐 #KeyTrap DoS: The DNSSEC Dilemma - A 25-Year-Old Design Flaw Exposed 🚨"

    In a groundbreaking discovery, researchers from the National Research Center for Applied Cybersecurity ATHENE have unveiled #KeyTrap (CVE-2023-50387), a critical flaw in DNSSEC's design that could bring the internet to its knees. With a severity rating of 7.5/10, this flaw in DNSSEC has been lurking since 1999, and affects 31% of global DNSSEC-validating DNS resolvers, risking widespread internet service disruptions. KeyTrap, an Algorithmic Complexity Attack, can overload a DNS server with a single packet, stalling major DNS providers like Google and Cloudflare for up to 16 hours. This vulnerability not only jeopardizes internet access but could also cripple essential security mechanisms like anti-spam defenses and PKI. Despite patches being rolled out, a permanent fix may necessitate a DNSSEC standard overhaul. 🌍💻🛡️

    CVE Details: mitre & nvd

    Tags: #CyberSecurity #DNSSEC #Vulnerability #InternetSafety #PatchNow #TechNews #InfoSecExchange #SecurityFlaw #DigitalInfrastructure 🚀🔒💡

    Source: ATHENE Press Portal

    #keytrap #cybersecurity #dnssec #vulnerability #internetsafety #patchnow
  14. Ondřej Surý @[email protected] ·

    Also hug your #DNS recursive resolver #Developers, they needed it for past couple of weeks and they couldn’t tell anyone.

    #DNSSEC #KeyTrap mstdn.social/@rysiek/111926495

    #dns #developers #dnssec #keytrap
  15. Gert van Dijk @[email protected] ·

    The Register: Just one bad DNS packet can bring down a public DNSSEC server

    #keytrap (CVE-2023-50387) #dnssec #dns #security

    theregister.com/2024/02/13/dns

    #keytrap #dnssec #dns #security
  16. Royce Williams @[email protected] ·

    I have two posts about the new multi-implementation DNSSEC validation DoS vulnerabilities CVE-2023-50387 ("KeyTrap") and CVE-2023-50868 (the NSEC3 vuln):

    • The big summary post (more editing - your client may notify you about each edit, which may be a feature):

    infosec.exchange/@tychotithonu

    • The post you're reading (low editing, minimal noise, but you might want to check the big post occasionally for updates).

    #keytrap #nsec3 #CVE202350387 #CVE202350868 #CVE_2023_50387 #CVE_2023_50868
    #dns #dnssec

    #keytrap #nsec3 #cve202350387 #cve202350868 #cve_2023_50387 #cve_2023_50868
  17. Michał "rysiek" Woźniak · 🇺🇦 @[email protected] ·

    Hug your #DNS recursive resolver #SysAdmin over the next few days. They might need it.

    #DNSSEC #KeyTrap

    #sysadmin #dns #keytrap #dnssec
  18. Royce Williams @[email protected] ·
    CW: New multi-implementation DNSSEC validation DoS vulnerabilities - CVE-2023-50387 ("KeyTrap"), CVE-2023-50868 (NSEC3 vuln)

    (living doc, updated regularly - if you prefer a low-edit post to boost, use infosec.exchange/@tychotithonu)

    Looks like DNS-OARC coordinated fixes in advance, but no centralized analysis at first other than the announcement from the team who discovered KeyTrap:

    Details may be still partially embargoed until patching ramps up.

    Analysis:

    DoS of all major DNSSEC-validating DNS resolvers (servers, but also maybe local resolvers like systemd's?) at the implementation level. Exploitation described as 'trivial'. Both are CVSS 7.5. DNS is a rich ransom target - but some resolver setups don't even validate DNSSEC.

    "In 2012 the vulnerability made its way into the implementation requirements for DNSSEC validation, standards RFC 6781 and RFC 6840" (per ATHENE)

    Per the Unbound writeup, both vulns require query to a malicious zone (which is probably not hard to trigger, for any DNSSEC-enabled client or server).

    Resolution: patch (recommended); disable DNSSEC validation (discouraged, but can buy you time / mitigate active DoS)

    Fixes mitigate the exhaustion by putting caps on validation activities. These caps appear to have been missing from most implementations.

    Details:

    Two DNSSEC DoS CVEs:

    CVE-2023-50387 ("KeyTrap"): "DNSSEC verification complexity can be exploited to exhaust CPU resources and stall DNS resolvers" (CVSS 7.5)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    seclists.org/oss-sec/2024/q1/1

    (KeyTrap was discovered by ATHENE - their press release here has very important detail:
    athene-center.de/en/news/press)

    CVE-2023-50868: "NSEC3 closest encloser proof can exhaust CPU" (CVSS 7.5)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    MITRE links (now populated):
    cve.mitre.org/cgi-bin/cvename.
    cve.mitre.org/cgi-bin/cvename.

    Vulmon queries:
    vulmon.com/searchpage?q=CVE-20
    vulmon.com/searchpage?q=CVE-20

    VulDB:
    vuldb.com/?id.253829

    Resolver status:

    BIND (patched - vuln since 2000?):
    fosstodon.org/@iscdotorg/11192
    kb.isc.org/docs/cve-2023-50387
    kb.isc.org/docs/cve-2023-50868
    seclists.org/oss-sec/2024/q1/1
    isc.org/blogs/2024-bind-securi
    (note: posts say "Versions prior to 9.11.37 were not assessed." but also have a range of affected versions starting at 9.0.0 - typo?)

    BIND tools:
    dig: no validation
    kdig: no validation
    delv: affected, patched

    dnsmasq (patched - 2.90 has fix):
    thekelleys.org.uk/dnsmasq/CHAN
    lists.thekelleys.org.uk/piperm

    Knot (patched in 5.7.1):
    knot-resolver.cz/2024-02-13-kn
    (kzonecheck also affected, patched?)

    ldns-verify-zone:
    affected per ATHENE paper

    OPNsense (patched):
    forum.opnsense.org/index.php?t

    pfSense:
    (Bundled Unbound: plan appears to be to make a separate package available for manual update?; BIND: optional package)
    forum.netgate.com/topic/186145
    redmine.pfsense.org/issues/152

    Pi-Hole (uses dnsmasq - patch available)
    patreon.com/posts/dnssec-fix-9
    pi-hole.net/blog/2024/02/13/fi

    PowerDNS (patched - all versions affected):
    blog.powerdns.com/2024/02/13/p
    github.com/PowerDNS/pdns/pull/
    github.com/PowerDNS/pdns/pull/
    seclists.org/oss-sec/2024/q1/1

    Stubby:
    [?]
    github.com/getdnsapi/stubby

    systemd.resolved:
    [?]

    Ubiquiti
    [?]

    Unbound (patched - vuln since Aug 2007):
    nlnetlabs.nl/news/2024/Feb/13/
    nlnetlabs.nl/downloads/unbound
    seclists.org/oss-sec/2024/q1/1

    Library status:*
    dnspython (GitHub patched):
    affected per ATHENE paper
    github.com/rthalley/dnspython/

    getdns (used by stubby - no patched release?):
    affected per ATHENE paper
    getdnsapi.net/releases/

    ldns (not yet patched?):
    affected per ATHENE paper
    github.com/NLnetLabs/ldns

    libunbound (used by Unbound):
    affected per ATHENE paper
    no recent patches?
    github.com/NLnetLabs/unbound/t

    Cloud status:

    Akamai:
    akamai.com/blog/security/dns-e

    Cloudflare:
    blog.cloudflare.com/remediatin

    Google DNS:
    (stated as patched in Register and SecurityWeek articles)
    [?]

    NextDNS (patched per forum reply):
    help.nextdns.io/t/h7yxwc5/does

    OS status:

    Debian:
    BIND:
    lists.debian.org/debian-securi
    pdns-recursor:
    lists.debian.org/debian-securi
    Unbound:
    lists.debian.org/debian-securi

    Fedora:
    bodhi.fedoraproject.org/update

    FreeBSD:
    cgit.freebsd.org/ports/commit/

    Gentoo:
    bugs.gentoo.org/show_bug.cgi?i

    Mageia:
    bugs.mageia.org/show_bug.cgi?i

    OpenBSD (unwind):

    Red Hat:
    bugzilla.redhat.com/show_bug.c
    access.redhat.com/security/cve
    access.redhat.com/security/cve

    SUSE:
    suse.com/security/cve/CVE-2023
    bugzilla.suse.com/show_bug.cgi

    Ubuntu:
    ubuntu.com/security/CVE-2023-5
    ubuntu.com/security/CVE-2023-5
    ubuntu.com/security/notices/US

    Windows (Server, DNS Role):
    msrc.microsoft.com/update-guid

    Package status:

    BIND:
    repology.org/project/bind/vers

    dnsmasq:
    repology.org/project/dnsmasq/v

    Unbound:
    repology.org/project/unbound/v

    GitHub:
    github.com/advisories/GHSA-845

    Go (Knot module?)
    github.com/golang/vulndb/issue

    Non-coverage: (no mentions known yet)

    AWS :
    [?]

    Azure (Microsoft Server DNS?):
    [?]

    Cisco Umbrella:
    umbrella.cisco.com/blog [?]

    CoreDNS:
    coredns.io/blog/ [?]

    Infoblox:
    blogs.infoblox.com/ [?]

    Quad9 DNS:
    quad9.net/news/blog/ [?]

    News/Press/Forums

    pducklin.com/2024/02/18/the-sc

    theregister.com/2024/02/13/dns

    securityweek.com/keytrap-dns-a

    bleepingcomputer.com/news/secu

    news.ycombinator.com/item?id=3

    darkreading.com/cloud-security

    Detection/Validation:

    Check to see if a server is doing DNSSEC validation (if not an open recursive resolver, you may need to query a zone the server is authoritative for):

    # zone signed, server DNSSEC-enabled:
    $ delv example.net @8.8.8.8
    ; fully validated
    example.net.            4437    IN      A       93.184.216.34
    example.net.            4437    IN      RRSIG   A 13 2 86400 20240225232039 20240204162038 18113 example.net. 94G2PRXins1G9ntfklvCq2mvcgqjB0z9FqQXp77lD/wXR4J3D67ceih1 yNgsYYqlIAOoWKXUekux6Zq9aIwszQ==

    # zone unsigned, server DNSSEC-enabled:
    $ delv google.com @8.8.8.8
    ; unsigned answer
    google.com.             100     IN      A       142.250.69.206

    Tenable:
    tenable.com/plugins/pipeline/i

    Snyk:
    security.snyk.io/vuln/SNYK-UNM

    Exploits:

    (multiple sources describe as "trivial")

    github.com/knqyf263/CVE-2023-5 (not tested)

    #keytrap #nsec3 #CVE202350387 #CVE202350868 #CVE_2023_50387 #CVE_2023_50868
    #dns #dnssec

    #keytrap #nsec3 #cve202350387 #cve202350868 #cve_2023_50387 #cve_2023_50868