DNS第一フラグメント便乗攻撃

22 Dec 2018 @NGK2018B

鈴木常彦 @ E-ONTAP

自己紹介

DNS第一フラグメント便乗攻撃とは

LT の時間じゃ足りないのでこれも説明省略 mOm

申し訳ないのでちょっとだけ説明

例えば

;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 14822
;; flags: qr aa rd ; QUERY: 1, ANSWER: 2, AUTHORITY: 3, ADDITIONAL: 8 
;; QUESTION SECTION:
;; www.nic.ad.jp.	IN	A

;; ANSWER SECTION:
www.nic.ad.jp.	300	IN	A	192.41.192.145
www.nic.ad.jp.	300	IN	RRSIG	A 8 4 300 20190304083401 20181204083401 46479 nic.ad.jp. ysjNTnPCReQdbO+xrCQUBjOuLX2l581VZtgCPMkTD3wYGh+WM3eHxypJf5Zr7Mkgz19FVX4Ia8L+ZXO35Hbyl9I4h9rdLeOVQWYOj1QoQtoatKANURjVndOCrk04s3o2hH9o8oIvmzHddJq8SkglfF6Um/FkTgTLe/y8oHg7P2IEaEMi3Bs0ueWCb0NSrQBIAfXifBvRV8ilA2QYKtdBbn1BQ6bzwHTMZiSdzQkXOVmlGta7/BIQoxUuBMcHxRtp8TUBoxEu441WOpKbAVBcBUW9M6tEFlWlGBizpWWM+X9jjhcvVMGbdhDfDiAB8VbFXRfjcO8wPTw2Mnn3nA90Pw==

;; AUTHORITY SECTION:
nic.ad.jp.	86400	IN	NS	ns5.nic.ad.jp.
nic.ad.jp.	86400	IN	NS	ns3.nic.ad.jp.
nic.ad.jp.	86400	IN	RRSIG	NS 8 3 86400 20190304083401 20181204083401 46479 nic.ad.jp. PjwcvC1iVPjGf1+SoemjZQWhIVLRc0eXIlZJod6vya6HMoa24TIVQBbmDB99AOEXuS3uV0Hi+A6yHG3vZBrVbRYc6Nejd5M6EUv6MuMdiOY/4HE+bT18mdy96nCNGluGh4JwlLDafngDFVw4IV134oWrQ0OfC269nLHuFpgy+OJxrQGoyUPR5tywbYnLgtXeWP07SpmuFCQsiIiEAdxRoXOs6ylj4LGk1baKY3WUli6naQ2k4e8BepuUe8gaIYzcQwy2tPmAcg0DncvyGKnZFCTbj7oUcRaumhgxS9SVFBOT1ZJZA2dIAWY2kKz8matlRiyLrBx6lA+92O4cQiIMag==

;; ADDITIONAL SECTION:
ns3.nic.ad.jp.	86400	IN	A	202.12.30.163
ns3.nic.ad.jp.	86400	IN	AAAA	2001:dc2:1000:2000::53
ns5.nic.ad.jp.	86400	IN	A	202.12.30.225
ns5.nic.ad.jp.	86400	IN	AAAA	2001:dc2:1000:2000::253
ns3.nic.ad.jp.	86400	IN	RRSIG	A 8 4 86400 20190304083401 20181204083401 46479 nic.ad.jp. tAtI3RzIpIGVcfCUeL7tkNbkS1+eKxzFR0PwR5prDAmv9CiQTx3lz2VoMq8MvIiOcgTBOqnhXxt66bLDYxDufrDgeC8gC22TDB6SstwfD9+tN5pmP3c+4jYiKsV75lKL0x+rodgo7y3NP1xrNNlQov2+tM1ACM7ERqG8lIiBDFZ3S1ZgaEVE0f4AgUPY7hRhEmTd+tvpvlpOQXz9QYdCaprUUQCMBRs4+xjSdKaaISxKr7n/b2I0sFBt+4zZPeXROPYFCcVe12gvNc8iU87A0X9s2FxsF+cRydj9qgM4bi4noyw+S8sdLfpIB/83CZxKB02ywPi818MOWidqmd+3cw==
ns3.nic.ad.jp.	86400	IN	RRSIG	AAAA 8 4 86400 20190304083401 20181204083401 46479 nic.ad.jp. sENVEzxMOMg9dd1xJtQ/ZLixkpP0zBxrQcWgLVzzXh7HMXmbj1TtkUGa1gCFEgNq8VsW4IXEjn85OhhycsjIJcu02CAdKZBJAO+Z8SO55PQ8YP9i8E7LPbYOON6HrIuMccvkuuzt/9yvAfb5Grqa6afKqFzyehJoavOr3zWVgtoYlFCRAC2ceYp4LDqC1Svwc+Sz6UyhDz03EzkRyiJmjuhviSlL/UIJWCycj+FEutUY1vvcNzCyBbPYSKM0zXmnafS/byClhdaaZ8qzvoi/kJvFDy7Wufubfendj7X+cpZrLiyN469D7AT40ME7mSzvzYu0//tPDkYwPq7fKCeyxA==
ns5.nic.ad.jp.	86400	IN	RRSIG	A 8 4 86400 20190304083401 20181204083401 46479 nic.ad.jp. esmIxR871ugtb0S46G2u3CBb+qDy9fsfNqZFBn1NwUOxdjybrE2Zp/tTWNkKllL+vqghiPkgA+ZJcW/P9IUin+2HFpSG73TDYDr5pY/jJ3MpmUC0HWgRoXtuk1peAvqxbeZYoZazWzpui1RpEhH5oOWqkGODZR3EucOEkIWwVZjZRO3VhKCQqJtKpMc8ASGahaBOW8Fkm/Q9+WjxUrW6SKhyV8T3dJfAPQlCURlXPFxaGwKtQm7f34CbdevbFsjHWRnGfA8Jb9umMDiFdVWel/La2jRWD30+7/HnSgL/mEAafEolgCRMf5DxE7oznRCPdH3kJdTw777cCySY5XL1wA==
ns5.nic.ad.jp.	86400	IN	RRSIG	AAAA 8 4 86400 20190304083401 20181204083401 46479 nic.ad.jp. xKPO273YSRL1UdCNlVtnqFZwHAnBKrTpWZOs2JWuYkLGNa3Fh1CtmDNgKHcuQKGloTmg9x4HemBuutF6gsdmfMQLrY1Vp+CbgMY7BuTwEKiv3pIt0Q8Aflk8XDJo+RVjxx+LBv04D9Iqo3YPDNAKT5YMNAteZspS+u1Ws0BxxPrhzv9e9gB+REGzkUAPpJbPXQdbWdmAekEWrh0PWTDdc4HcRvyiiN/cz/z6k8cXUfeh4K+bmxkcqjui8jRBjlBpK2LCwDfRrsu93U0YOkHfAUVr8qzuuX4f3fqIa2L0NaS+lnTdih6xEjioGpCECfUC/zS95h8wUA1lcVVj+ay0iA==

具体的にはどうすれば毒いれ可能?

何しに来たの?

どうすればいい?

どうすればいい?

どうすればいい?

詳しくはどこで聴ける?