Mitigate A New CERT Vulnerability (#598349) With An Entry In /etc/hosts

There is a new CERT vulnerability that can leave you vulnerable to a Man-in-the-Middle attack.  You can mitigate this vulnerability today by adding these two lines to your /etc/hosts file:

0.0.0.0 wpad wpad.example.com 
:: wpad wpad.example.com

example.com is a stand in for your local domain.  So replace example.com with whatever your local domain is.

The essence of this vulnerability is that an attacker can add a device to the network named wpad and get a DHCP lease, thus inserting the name wpad.example.com in the local DNS pointing to the attacker’s machine.  The presence of that A record allows control of the proxy settings of any browser in the network.

You can learn more about the technology behind this attack at Google’s Project Zero page–it’s an older article, but gives some insight into the inner workings of the attack.

The next release of dnsmasq includes an option (dhcp-ignore-names) that can be used to mitigate the attack at the source, but we haven’t heard how Simon will act on this new vulnerability.

Since FTLDNS is just our fork of dnsmasq, we can easily merge in any upstream changes from him, but we wanted to let you know of the /etc/hosts fix that you can immediately implement.

Notable Replies

  1. jfb says:

    What would be the correct settings for a domain with no name?

    domainname
    (none)

  2. You’re defining the redirect/no need to double it. Likely, your router is appending .lan to your hostname. Try to ping it, ie

    ping foo.lan
    

    If it that returns bytes, you can use both 0.0.0.0 wpad wpad.lan

  3. @jacob.salmela
    A long time ago, I responded to a topic, regarding excessive wpad queries and provided a solution to have lighttpd respond.
    Does this imply that the solution is no longer a good solution?

    I’m aware the solution doesn’t have an entry for IPv6, but this can be easily fixed, NOT sure if lighttpd will also provide the response…

    edit
    The solution was further discussed in this topic, section Q/A (Q: Why so many local requests?)
    /edit

    edit2
    checked to see if IPv6 requests are responded to by lighttpd -> YES

    IPv4 request (http://192.168.xxx.xxx/wpad.dat), entry in the lighttpd log

    1536659104|192.168.xxx.xxx|GET /wpad.dat HTTP/1.1|200|56
    

    IPv6 request (http://[2a02:1810:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx]/wpad.dat), entry in the lighttpd log

    1536659116|[2a02:1810:xxxx:xxxx:xxxx:xxxx:xxxx:xxxx]|GET /wpad.dat HTTP/1.1|200|56
    

    /edit2

  4. Tho says:

    What about using the Pi-Hole blacklist instead editing the hosts file?

    Seems to work fine for me, by just adding

    ^wpad*

    as a Regex to the blacklist.

  5. Tho says:

    You’re right, thanks msatter. Thought it needs to have a * to match wpad.custom_tld (ie wpad.box) but it will Interpret ^wpad as the beginning of a domain string anyway matching wpad and wpad.box .

    Using ^wpad* would also match wpaddington which is overkill.

    Anyway is there any drawback in using the blacklist instead of the hosts?

Continue the discussion discourse.pi-hole.net

15 more replies

Participants