Lab 2: SSL Security Attack June 17, 2008 Hyun Jin Kim

Objective Configure DNS such that gets resolved to our own IP address of the “attack” server – Paypal uses SSL protocol.

Normal DNS Query Processing DNS Server Paypal’s Server

Attacking DNS Request DNS Server Paypal Server Fake Paypal Server Filter

What We Will Do Write a program that injects a spoofed DNS Response when the source queries the IP address of C programming Basic skeleton of codes are provided. Attacker’s fake server is also provided.

Libraries Libpcap – To capture DNS requests – /usr/include/pcap.h Libnet – To inject fake DNS replies – /usr/include/libnet.h

Procedures Setup for packet sniffing Grab packets Check if packets are DNS queries If the query is for inject a spoofed DNS response backwww.paypal.com Web browser will direct to attacker’s fake paypal website!

Step 1: Packet Sniffing Setup Find the network interface for sniffing – device = pcap_lookupdev(errbuf); eth0 in our case Set up for sniffing – capdev = set_cap_dev(device, filter); filter specifies some properties of DNS Requests – UDP packets – Destination port = 53

Step 2: Grab a DNS Query Packet Grab a packet (first fill-in)‏ – packet = (u_char *) pcap_next(capdev, &pcap_hdr); Check if the packet is a DNS Query – i.e., Destination port = 53? Check if the DNS Query is for

Step 3: Create Spoofed DNS Response Create a new DNS Response with Attacker’s IP address Send it back to the source void spoof_dns(char *device)‏ – Open a raw socket – Start creating the header for the spoofed response

Step 3: Create Spoofed DNS Response Header Construction – Build DNS Header (fill in)‏ – dns = libnet_build_dnsv4(LIBNET_DNS_H, /* header size */ ntohs(spoofpacket.dns_id), /* dns id */ 0x8100, /* control flags (QR,AA,RD,*/ 1, /* number of questions */ 1, /* number of answer RR's */ 0, /* number of authority RR's*/ 0, /* number of additional RR's*/ spoofpacket.payload, /* payload */ spoofpacket.payload_size, /* payload length */ handler, /* libnet handler */ 0); /* ptag */ – Build UDP Header – Build IP Header – Calculate Checksum (fill in)‏ libnet_toggle_checksum(handler, udp, 1); libnet_toggle_checksum(handler, ip, 1);

Step 4: Inject DNS Response Inject the packet (fill in)‏ – inject_size = libnet_write(handler); Destroy the packet (fill in)‏ – libnet_destroy (handler);

Test Compile – Type make Run – Type./sslattack Open a web browser Type – No attack Type – Certificate Warning Sign

Certificate

Spoofed paypal.com

Actual paypal.com