Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Wed, Feb 18, 2009 at 8:15 PM, Paul Jarc <[email protected]> wrote:
> Ok, I think I see what you're saying.  If I'm right, a description
> like this would have been far, far clearer:
> 1. An attacker floods a qmerge-patched dnscache with 200 identical
>   queries.
> 2. dnscache forgets all previous outgoing queries, and sends just one
>   new outgoing query.
> 3. The attacker probes the dnscache box to see what UDP ports are in
>   use.
> 4. The attacker uses only those ports in their forged responses.
>   Since the attacker has reduced the number of ports to choose from
>   by possibly as many as 199, the odds are better of guessing the
>   right port.

Let's be generous and say there's a way for an attacker to
instantaneously determine all active UDP ports on a remote host on the
Internet.  (I've already posted about my effort to experimentally
determine whether this is possible; I'm inclined to believe that in
general it's not.)  Let's also be generous and say that following step
2, dnscache doesn't receive any more inbound queries until the
attacker has given up.

Now suppose when you want to attack dnscache that there are N active
UDP ports on the target host not counting dnscache outbound query
ports.  Carrying out the above attack against dnscache without the
qmerge patch means there are 200 active UDP ports from dnscache, so an
attacker choosing a random port to attack has a 200 / (N + 200) chance
of picking a valid port.  Against dnscache with the qmerge patch means
there is only 1 active UDP port from dnscache, so the attacker's
chance of picking the correct port reduces to 1 / (N + 1).

Note that if N = 0, then the probabilities are the same (100%), but if
N > 0, then the attacker has a lower chance of success against patched
dnscache than against unpatched dnscache (i.e., the odds are *worse*
at guessing the right port).