Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

Dean Anderson <[email protected]> wrote:
> In either case, instead of trying to find 200 ports out of 64510,
> one knows the 200 ports + plus those in use by other things. In that
> case, the task is significantly reduced.  If there is just one port
> for DJBDNS plus those in use by other things, the task is easier
> still.  Reducing the number of ports being used and returned affects
> the entropy of the port numbers and makes another attack possible.

Ok, I think I see what you're saying.  If I'm right, a description
like this would have been far, far clearer:
1. An attacker floods a qmerge-patched dnscache with 200 identical
   queries.
2. dnscache forgets all previous outgoing queries, and sends just one
   new outgoing query.
3. The attacker probes the dnscache box to see what UDP ports are in
   use.
4. The attacker uses only those ports in their forged responses.
   Since the attacker has reduced the number of ports to choose from
   by possibly as many as 199, the odds are better of guessing the
   right port.

Is this the attack you have in mind?

I don't think this attack works any better against a qmerge-patched
dnscache.  Although dnscache forgets about its previous outgoing
queries, the kernel doesn't know that it has forgotten.  There's no
external evidence that would show up in the attacker's probe.

> Day and Kaminsky have been working together since Kaminsky claimed that
> DNScache was vulnerable at Blackhat last summer.

"Working together" sounds like an overstatement, based on what Kevin
has said.  Not that it matters, anyway - I'm not going to speculate
about anyone's motives.  I just want to understand the technical
impact of the patch, which is independent of anyone's motives.


paul