Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

Dean Anderson <[email protected]> wrote:
> On Fri, 13 Feb 2009, Paul Jarc wrote:
>> The rate of consuption of UDP ports is still 1 port per outgoing
>> query, with or without the patch.  If changing the ratio of
>> incoming queries to outgoing queries is relevant, I don't see how.
>
> ??? 
>
> The rate of consumption of ports is substantially less.

Per incoming query, yes.  Per outgoing query, no.  Why does it matter
how many ports are consumed per incoming query?

> It uses a PRNG 10 times to pick a port that isn't already in use. If
> that fails, it uses whatever port the OS gives it.

True, but it's not clear that that helps an attacker.  The OS-assigned
port may be easier for them to guess (depending on the OS), but in
order to know that dnscache is using an OS-assigned port, wouldn't
they have to predict the 10 PRNG port numbers, and know that those
ports were in use?

> I don't usually open PDF's from blackhats if I don't have to, since the
> format can contain javascript exploits which can elude my virus scanner.

Your PDF viewer runs Javascript?

> I don't know if the PDF contains the correct or incorrect math.

Well, the PDF is the analysis in support of Jeff King's patches.  In
deciding whether to apply those patches, I'm interested in the
correctness of *that* analysis, not some other analysis which may have
some parts in common.


paul