Re: djbdns/dnscache poisoning weakness

Not exactly. There is only one set of authentic facts, and the facts
support my analysis.

====================== Excerpt from my comments to the NTIA on DNSSEC
http://www.ntia.doc.gov/dns/comments/comment027.pdf

Kaminsky-Vixie "Media Hack"

Much attention has been given to DNSSEC after the "Kaminsky Attack" was
described. The December 2008 issue of MIT.s Technology Review reports
the "Media Hack" aspect of the event. The truth of the matter as,
reported by Technology Review on pg. 64 is that "Kaminsky had not really
discovered a new attack". Dr. Bernstein discovered this attack many
years ago, and fixed the DNSCache server software in 1999. The PowerDNS
caching server was fixed in 2006. In 2006, NLnet (Kolkman et al) noted
the spoofing of NS Records. A design report for the Unbound DNS Server
software, developed by Nominet, Verisign, NLnet Labs (Kolkman et al),
EP.NET (Bill Manning)) in which the authors describe that "spoofed NS
additionals confuse iterator"4. This paper was discussed at IETF 67, in
November 2006.

Kaminsky is also connected to other questionable activity. In January
2006, Kaminsky announced he had found 580,000 open recursors at a hacker
conference called Schmoocon. Its unclear how all this scanning was done
without notice or complaint. Coincidentally, the first DNS reflection
attack is reported to have taken place in October 2005 in a paper by
Professor Vaughn of Baylor University and Gadi Evron5 These events are
the subject of a document called "draft-ietf-dnsop-reflectors-are-evil",
which seeks to close all open recursive DNS Servers. After news of the
"Kaminsky Attack" leaked out, Kaminsky wrote on Twitter: 

   "DNS bug is public. You need to patch, or switch to OpenDNS, 
    RIGHT NOW."

OpenDNS is a company that offers Open Recursor service, using open
recursors to provided DNS services that deny DNS to phishing sites, and
enable the collection of data on user browsing preferences, which is
presumably mined for marketing research and other statistics. There are
connections between Vixie et al (the BIND Cartel) and OpenDNS founder
David Ulevitch and OpenDNS employee Bill Fumerola. 

Every part of Kaminsky's "attack" was well-known to most DNS experts for
a long time, including Paul Vixie. Vixie describes his conversation with
Kaminsky very dramatically as "taking 20 seconds to explain the
problem." Vixie, having debated the issue with Bernstein, should have
realized in that 20 seconds that the problem Kaminsky described was
well-known. Instead, with great drama Vixie says:

  "Dan, I am speaking to you over an over an unsecure cell phone. 
   Please do not ever say to anyone what you just said to me over an
   unsecure cell phone again"

But the well-known bug just doesn.t warrant that sort of drama.

Dan Kaminsky and Kevin Day subsequently asserted that there was a
problem in DNSCache software. Their proposed fixes, discussed offlist
with Dean Anderson, would have introduced a combination of two Birthday
attacks into DNSCache, leaving it even MORE vulnerable to spoofing
attacks.6 Nothing more has been reported by either Kevin Day or Dan
Kaminsky regarding bugs in DNSCache. No vulnerability was ever
identified in DNSCache. The code patching BIND has not been analyzed for
the presence of the combined Birthday attacks.

The Technology Review discusses how a great deal of "urgency" was
artfully created. A reasonable review of the facts shows that the alarm
is completely without justification. As a result of the .urgency., many
people deployed software changes that weren.t properly reviewed. This
massive software update, performed on blind trust, is unprecedented in
the history of the Internet. The urgency was unjustified, and one must
question whether deployment of DNSSEC as a knee-jerk reaction to a
artfully created but unjustified perception could ever be wise. Instead,
I think the connections between Kaminsky and the BIND Cartel DNSSEC
promoters ought to be investigated to see if there was an effort to
trick the government IANA function into adopting DNSSEC under artfully
created, but false "urgency".

======================


Their version of the facts, that they discovered a new dns cache
poisoning, isn't a fact. They "urgently" told people they had discovered
a new vulnerability and they they had "changes" to implmement "NOW" or
change to Vixie crony Ulevitch's OpenDNS. 

Kaminsky is in the same place and time as the first abuser of dns
recursors, collecting open recursors. 

Kaminsky collects 500,000 open recursors, about 25 times the largest
number ever collected by an academic researcher.  By coincidence, some
recursors are configured by ISPs to be only half-open, open on an
internal interface, but closed on the external interface. Such
recursor's would seem 'open' to a botnet client operating on internal
(open) interface, but would seem closed when Professor Vaughn tested
them, as Vaughn actually found.

This isn't 'proof beyond reasonable doubt', but it does make it 'more
likely than not'

And I'm still going through the offlist/onlist discussion with
Day/Kaminsky. I'll probably put this up in a web page sometime this
week.

		--Dean


On Tue, 10 Feb 2009, Mark Johnson wrote:

> On Mon, Feb 9, 2009 at 8:25 PM, Dean Anderson <[email protected]> wrote:
> > I recommend ignoring these patches and avoiding any server that uses
> > these patches.
> >
> > I have discovered that Kaminsky was searching for open recursors roughly
> > during the time of the first open recursor attack reported in October
> > 2005.  Kaminsky reported finding about 500,000 open recursors at
> > Schmoocon in January 2006.
> >
> > When the 'DNS cache scare' started last summer, Kaminsky tried to get
> > people to convert to David Ulevitch's OpenDNS service. The scare also
> > prompted efforts to promote DNSSEC.  These are "scare" scams, not
> > legitimate threats for which people should change DNS software.
> >
> > Previous analysis of the Kevin Day/Dan Kaminsky proposed changes to
> > DNSCACHE revealed that they would ADD EXTREME WEAKNESS not fix weakness,
> > making it possible to poison a cache in about 1000 messages. I have not
> > yet analyzed the BIND changes, and do not know if they suffer the same
> > weaknesses as the DNSCACHE changes.
> 
> Pot.  Kettle.  Black.  You're engaging in the same kind of scare
> tactics that you accuse Kevin of.
> 
> 

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000