Intro + DNS BailiWicked

Welcome to my brand new blog!
(yay >_>)
My name is Andrew Herzog, and I am a IT Network Security student in Australia within TAFE.
This is something of a forced effort, I really don't enjoy writing my thoughts down for the world to see... but hey might as well make the best of it.
Within this blog all I'll really be doing is putting into the blogosphere some of my (not so important) thoughts on Networking, security and some of the more interesting vulnerabilities and hardware/ software I encounter as I complete my studies.

So now that introductions are out of the way, lets get right into something that is quite common news already, but hey I only really discovered the depths of the vulnerability and exploits of it today.
Unpatched DNS servers have been found to be easily exploitable using Kaminsky's DNS poisoning flaw. What this means is that its rather easy at the moment to launch a man in the middle attack against clients.
Metasploit is what seems to be an awesome set of tools which are used to discover vulnerabilities within your network. Within 15 days of this DNS poisoning flaw being discovered Metasploit already included modules which could be used to inject fake DNS records into DNS servers.
http://blog.metasploit.com/2008/07/bailiwicked.html
Now what really scares me at this point is this post including a video I discovered along with Metasploit.
http://blog.metasploit.com/2008/07/evilgrade-will-destroy-us-all.html
Evilgrade uses this DNS exploit along with another flaw within many applications update mechanisms. The list is rather surprising as well, iTunes, MacOS, openOffice just to name a few. So an attacker uses metasploit to inject fake dns records onto the dns server used by the end user, then when the user begins an update instead of finding the software's website they are redirected to a malicious site, complete with a hacked executable provided by evilgrade ready to create the backdoor.

Call me misguided, but I never quite realised just how easy some of this was until recently. Its truly mind boggling how easy this attack is, just about anyone even slightly tech savvy could use it.