Re: Trouble with Sender Authentication

On Nov 9, 2006, at 3:15 PM, william(at)elan.net wrote:

> Doug, I don't have time for long discussion. But I'm telling you  
> that SPF has nothing to do with it and I can use either of "MX",  
> "SRV" or "NS" to generate similar amplification scenarios as you've  
> done with SPF using the same method.

Multiples of 100s of crafted DNS transactions directed toward a  
victim by each message can not be compared against transactions  
needed to obtain an MX, SRV, or NS resource record.  The MX, SRV, or  
NS resource records provide access to a service prompted by the  
client and not an attacker.  SPF scripts allow an attacker to  
orchestrate hundreds of transactions at millions of recipients. The  
gain of this exploit is large and essentially free for an attacker  
also wanting to spam.  For what other exploit would is be true?

> In fact CSV (as far as I remember it) would cause highier amount of  
> amplification then SPF when bad guy controls domain put in EHLO and  
> decides to play special dns games with that name.

CSV specified that a single target be used.  When associated with  
DKIM per DOSP, an address literal or a single A record offers  
sufficient validation.  Validating the EHLO simply does not offer any  
gain; nor is this gain is not multiplied by subsequent stages or  
multiple recipients.  SPF script transaction amplification is not  
10:1 but more than 100:1.  The gain executing SPF script is  
multiplied by recipients and stages of delivery, such as MTAs and MUAs.

> And in exactly the same way as you did it would generate 10:1 DNS  
> traffic amplification (SPF scenarios are basicly 10:1 amplification  
> after throwing away all the extras).

Some SPF scenarios are much larger than 10:1.  SPF scripts can cause  
havoc by additional 10 or 11 TXT wildcard resource record  
transactions, but I'll leave that to your imagination.  Any SPF  
script exploit bypasses protections offered by DNS ACLs and BCP38. : (

-Doug