Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

Dean Anderson <[email protected]> wrote:
> On Sun, 1 Mar 2009, Paul Jarc wrote:
>> How, exactly?  What is the algorithm the attacker would use?
>
> I already described two scenarios. 

I believe these were the two; please confirm whether I have these right:

1. Flood dnscache with 200 identical queries, causing it to forget all
   previous outgoing queries.  Detect the ports in use by dnscache.
   Forge responses to just those ports, rather than all possible
   ports.

I don't see how this attack is more effective against a qmerge-patched
dnscache, since the old sockets for the previous outgoing queries are
kept open.  The detection will show 200 ports to attack regardless of
whether qmerge is in use.

2. Flood a qmerge-patched dnscache with 200 identical queries.  Use
   DOS techniques to block the outgoing query or the incoming genuine
   response, to allow more time for forged responses to get in.

I don't see how this attack is more effective than the same situation
with just one query, against either unpatched or qmerge-patched
dnscache.

> Public implementation of cracks is an exercise that I have no
> interest in.

I asked for an algorithm, not an implementation.

> The important point is that these 199 other responses aren't prevented,
> the end user isn't poisoned on that particular query,

But the attacker still poisoned the record they were trying to poison,
using extra in-bailiwick records that weren't asked about in the
query.  If I steal your wallet, would you say it doesn't matter,
because you still have your handkerchief?

> and each could potentially be cached preventing poison.

Having a record cached doesn't prevent poison.  It only prevents
dnscache from querying for that record.  An attacker can still replace
it with poison by triggering queries for nonce names in the same
bailiwick, and forging responses for those queries.


paul