View
217
Download
4
Category
Preview:
Citation preview
Lab 2: SSL Security Attack
June 17, 2008
Hyun Jin Kim
Objective
• Configure DNS such that https://www.paypal.com gets resolved to our own IP address of the “attack” server– Paypal uses SSL protocol.
Normal DNS Query Processing
www.paypal.com
64.4.241.33
DNS Server
Paypal’s Server
Attacking DNS Request
www.paypal.com
128.222.11.3
DNS Server
Paypal ServerFake Paypal Server
Filter
What We Will Do
• Write a program that injects a spoofed DNS Response when the source queries the IP address of www.paypal.com
• C programming• Basic skeleton of codes are provided.• Attacker’s fake server is also provided.
Libraries
• Libpcap– To capture DNS requests– /usr/include/pcap.h
• Libnet– To inject fake DNS replies– /usr/include/libnet.h
Procedures
• Setup for packet sniffing• Grab packets• Check if packets are DNS queries• If the query is for www.paypal.com, inject a
spoofed DNS response back• Web browser will direct to attacker’s fake
paypal website!
Step 1: Packet Sniffing Setup
• Find the network interface for sniffing– device = pcap_lookupdev(errbuf);• eth0 in our case
• Set up for sniffing– capdev = set_cap_dev(device, filter);• filter specifies some properties of DNS Requests
– UDP packets– Destination port = 53
Step 2: Grab a DNS Query Packet
• Grab a packet (first fill-in)– packet = (u_char *) pcap_next(capdev, &pcap_hdr);
• Check if the packet is a DNS Query– i.e., Destination port = 53?
• Check if the DNS Query is for www.paypal.com
Step 3: Create Spoofed DNS Response
• Create a new DNS Response with Attacker’s IP address
• Send it back to the source• void spoof_dns(char *device)– Open a raw socket– Start creating the header for the spoofed
response
Step 3: Create Spoofed DNS Response
• Header Construction– Build DNS Header (fill in)– dns = libnet_build_dnsv4(LIBNET_DNS_H, /* header size */
ntohs(spoofpacket.dns_id), /* dns id */ 0x8100, /* control flags (QR,AA,RD,*/
1, /* number of questions */ 1, /* number of answer RR's */
0, /* number of authority RR's*/ 0, /* number of additional RR's*/ spoofpacket.payload, /* payload */ spoofpacket.payload_size, /* payload length */ handler, /* libnet handler */
0); /* ptag */
– Build UDP Header
– Build IP Header
– Calculate Checksum (fill in)• libnet_toggle_checksum(handler, udp, 1);• libnet_toggle_checksum(handler, ip, 1);
Step 4: Inject DNS Response
• Inject the packet (fill in)– inject_size = libnet_write(handler);
• Destroy the packet (fill in)– libnet_destroy (handler);
Test
• Compile– Type make
• Run– Type ./sslattack
• Open a web browser• Type http://www.naver.com– No attack
• Type https://www.paypal.com– Certificate Warning Sign
Certificate
Spoofed paypal.com
Actual paypal.com
Recommended