1. Lab 2: SSL Security Attack June 17, 2008 Hyun Jin Kim

2. Objective Configure DNS such that https://www.paypal.com gets resolved to our own IP address of the “attack” server https://www.paypal.com – Paypal uses SSL protocol.

3. Normal DNS Query Processing www.paypal.com 64.4.241.33 DNS Server Paypal’s Server

4. Attacking DNS Request www.paypal.com 128.222.11.3 DNS Server Paypal Server Fake Paypal Server Filter

5. What We Will Do Write a program that injects a spoofed DNS Response when the source queries the IP address of www.paypal.comwww.paypal.com C programming Basic skeleton of codes are provided. Attacker’s fake server is also provided.

6. Libraries Libpcap – To capture DNS requests – /usr/include/pcap.h Libnet – To inject fake DNS replies – /usr/include/libnet.h

7. Procedures Setup for packet sniffing Grab packets Check if packets are DNS queries If the query is for www.paypal.com, inject a spoofed DNS response backwww.paypal.com Web browser will direct to attacker’s fake paypal website!

8. Step 1: Packet Sniffing Setup Find the network interface for sniffing – device = pcap_lookupdev(errbuf); eth0 in our case Set up for sniffing – capdev = set_cap_dev(device, filter); filter specifies some properties of DNS Requests – UDP packets – Destination port = 53

9. Step 2: Grab a DNS Query Packet Grab a packet (first fill-in)‏ – packet = (u_char *) pcap_next(capdev, &pcap_hdr); Check if the packet is a DNS Query – i.e., Destination port = 53? Check if the DNS Query is for www.paypal.comwww.paypal.com

10. Step 3: Create Spoofed DNS Response Create a new DNS Response with Attacker’s IP address Send it back to the source void spoof_dns(char *device)‏ – Open a raw socket – Start creating the header for the spoofed response

11. Step 3: Create Spoofed DNS Response Header Construction – Build DNS Header (fill in)‏ – dns = libnet_build_dnsv4(LIBNET_DNS_H, /* header size */ ntohs(spoofpacket.dns_id), /* dns id */ 0x8100, /* control flags (QR,AA,RD,*/ 1, /* number of questions */ 1, /* number of answer RR's */ 0, /* number of authority RR's*/ 0, /* number of additional RR's*/ spoofpacket.payload, /* payload */ spoofpacket.payload_size, /* payload length */ handler, /* libnet handler */ 0); /* ptag */ – Build UDP Header – Build IP Header – Calculate Checksum (fill in)‏ libnet_toggle_checksum(handler, udp, 1); libnet_toggle_checksum(handler, ip, 1);

12. Step 4: Inject DNS Response Inject the packet (fill in)‏ – inject_size = libnet_write(handler); Destroy the packet (fill in)‏ – libnet_destroy (handler);

13. Test Compile – Type make Run – Type./sslattack Open a web browser Type http://www.naver.comhttp://www.naver.com – No attack Type https://www.paypal.comhttps://www.paypal.com – Certificate Warning Sign

14. Certificate

15. Spoofed paypal.com

16. Actual paypal.com