Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Wed, Feb 18, 2009 at 1:07 PM, Dean Anderson <[email protected]> wrote:
> If one has fewer ports being used by DNScache, one might be able to
> discover those ports by scanning.

How do you suggest to scan for these ports?  I hacked dnsq to wait
much longer than normal for UDP response packets and ran it on both
Linux and OpenBSD, sending queries to a non-existent host on the local
network.  I then ran "nmap -sU" against each of these machines
including both the port in use by dnsq as well as some other unused
ports, and nmap listed all of them as "closed".

> Blocking ICMP might help, but an
> unprivileged process on the same machine can't be blocked, and can
> usually get a list of ports.

This is a luxury most attackers don't have, and it's irrelevant to the
discussion of Kevin Day's qmerge patch: dnscache is equally vulnerable
to a local process that can see which UDP ports are in use whether the
qmerge patch has been applied or not.

> If there
> is just one port for DJBDNS plus those in use by other things, the task
> is easier still.  Reducing the number of ports being used and returned
> affects the entropy of the port numbers and makes another attack
> possible.

What do you do about a dnscache server that only ever receives 1 query
at a time?  Do you think it's more vulnerable to forgeries than one
that constantly has 200 queries to resolve concurrently?  Should
administrators add artificial load to their dnscache installations to
ensure that they always have 200 active queries?