Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Wed, Feb 18, 2009 at 02:49:30AM -0500, Paul Jarc wrote:

> > It uses a PRNG 10 times to pick a port that isn't already in use. If
> > that fails, it uses whatever port the OS gives it.
> 
> True, but it's not clear that that helps an attacker.  The OS-assigned
> port may be easier for them to guess (depending on the OS), but in
> order to know that dnscache is using an OS-assigned port, wouldn't
> they have to predict the 10 PRNG port numbers, and know that those
> ports were in use?

Assuming the PRNG is secure, an attacker could guess that dnscache will
fail to get a port and get stuck with whatever predictable value the OS
hands out. However, the chances of the happening are pretty slim. If N
ports are already in use, then the probability that we hit one of them
all ten times is (N/64510)^10. For MAXUDP=200, if there are no other UDP
users on the system, that's on the order of 10^26.

> > I don't usually open PDF's from blackhats if I don't have to, since the
> > format can contain javascript exploits which can elude my virus scanner.
> 
> Your PDF viewer runs Javascript?

My understanding is that recent versions of Acrobat run Javascript; why
he can't use a different PDF reader, or a version of Acrobat with
Javascript turned off, I can only imagine.

-Peff