Subject: Re: dictionary attack on nameservers

From: Alex Bligh <[email-masked]>
Date: Fri, 13 Aug 2004 10:12:35 +0100

--On 13 August 2004 09:16 +0200 "Marcos Sanz/Denic" <[email-masked]> wrote:

> Based on a combined German-English dictionary with more than 100,000
> words  and feeding John the Ripper with it to produce a wider attack
> base, I was  only able to recover 80,000 domains, accounting to 1% of the
> total zone.

Interesting - is that after a full run? IE you didn't stop because you
got bored.

Anyone have an obvious large source of in-addr.arpa PTR
records that we could do use to extract .de names and get the percentage of
the total .de zone size that yields (even with false positives)?

Alex

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Fri, 13 Aug 2004 13:46:56 +0200 (CEST)

On Fri, 13 Aug 2004, Marcos Sanz/Denic wrote:

> On the heels of Miek's communication about the success of a dictionary
> attack on the nl-zone (size ca 1 million), I replicated the attack on the
> de-zone (size ca 8 millions). Thanks to Miek for the scripts.
>
> Based on a combined German-English dictionary with more than 100,000 words
> and feeding John the Ripper with it to produce a wider attack base, I was
> only able to recover 80,000 domains, accounting to 1% of the total zone.
>
> I guess it could be postulated that, by means of a dictionary attack, the
> amount of the domains that can be recovered from a zone remains constant,
> and that its effectivity diminishes inversely proportional to the growing
> size of the zone.

Another interesting test would be to hash the entire .de zone, and do a 7
character wide (ie. 37^7) bruteforce on the hashes (since it is trivial
to enumerate hashes using NSEC++ ).

My cpu is capable of about 300000 h/s.

So an entire OFFLINE bruteforce takes about

37^7/300000/86400 = 3 days, 16 hrs.

To optimise, given that changing salt is costly, a dictionary of
truncated, non colliding hashes(bruteforce/salt) can be built, which is 89
Gbyte (or 3Gbyte using rainbow tables), after which lookups are trivial.

This is just to show that hashing does not do wonders.

Marcos, could you share with us the percentage of the .de zone which have
labels < 8 characters ?

Thanks,

Roy Arends

---

From: Miek Gieben <[email-masked]>
Date: Mon, 16 Aug 2004 13:58:57 +0200

[On 13 Aug, @09:16, Marcos wrote in "Re: dictionary attack on names ..."]
> On the heels of Miek's communication about the success of a dictionary 

just for the curious, I've just done the following:

What is the best dictionary on the planet to attack a zone file? 
Indeed, the .com and .net zone files. So that's what I did, I tried
to see how much of .com/.net is in the .nl zone.

Note: I did an OFFLINE attack, which took a few hours. (This can be
optimized, the script I use is lame)

The results:
.com contains about 29 million names. After some time I got 495913
names out of the 1187008 names in the NL zone.  This is 41.77 percent
of the NL zone

.net contains 4861825 names. After some time I got 285674 names. That
is 24.06 percent of the NL zone.

If I combine .com and .net (taking into account some overlap) I get
504758 out of 1187008 names. This is 42.52 percent of NL zone.

grtz Miek

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 16 Aug 2004 14:52:12 +0200

> to see how much of .com/.net is in the .nl zone.
...
> 504758 out of 1187008 names. This is 42.52 percent of NL zone.

Care to repeat this for, e.g., josefsson.org?  The zone walking issue
is not limited to the zones that are best suitable for dictionary
attacks.  I believe enumerating small zones is more difficult.
Further, it may be more useful to be able to enumerate small zones,
compare:

  Steven M. Bellovin, "Using the Domain Name System for System Break-Ins", in
  Proceedings of the Fifth Usenix UNIX Security Symposium, Salt Lake City, UT,
  June, 1995. http://www.research.att.com/~smb/papers/dnshack.pdf

Btw, AXFR is permitted for josefsson.org, if you want to compare
success rate of a dictionary attack.

Thanks,
Simon