Re: 2 forwarded messages...DNSEXT discussion of Day and Kaminsky

On Wed, Mar 04, 2009 at 09:14:42PM -0700, Andy Bradford wrote:

> > For a single query, we expect the attacker to require around 2 billion
> > packets.  For  a 10Mbps  link,  this  would  take  about 40  hours  of
> > sustained attack. However, if the attacker triggers multiple identical
> > queries, then  they require only  about 16 million  packets, requiring
> > only 18 minutes on the same link.
> 
> Unless my math is wrong, that equates to about 13,888 packets per second
> sustained  for 40  hours,  right?  That's a  lot  of  packets for  small
> operations, and  would likely  be easily noticed.  For a  larger outfit,
> that may not even show up as a blip.

Right. The point is that is that 40 hours of sustained attack (which is
what stock dnscache is susceptible to without a birthday attack, or
qmerge-patched dnscache is susceptible to at all) is probably too much
for an attack to get by unnoticed (and at any rate is the best we can do
considering the limitations of the protocol).

The birthday attack drops an attack against stock dnscache over a 10Mbps
link to 18 minutes. So the risk of the attack is based on whether that
is "too much" for an attacker.

On a 100Mbps link, it is 1.8 minutes. If you have bumped MAXUDP, it can
be a matter of seconds.

So the risk to an unmodified dnscache server sitting behind a slow DSL
link is relatively low. One where MAXUDP has been bumped up to serve a
100Mbps LAN is at much higher risk.

> And yet, the  more packets per second  that are sent, the  more risk the
> attacker has in actually bringing down your infrastructure, or otherwise
> triggering alarms. What is the likelyhood that something like this would
> go unnoticed?

Right. That's why I tried to give numbers instead of claiming that the
sky is falling; each installation needs to assess its own risk.

I don't know how many packets in a poisoning attempt is "too much". It
is my understanding that since Kaminsky's talk, there have been actual
exploits of unpatched BIND in the wild. So clearly there is a number
that is "too little to be noticed", at least for some sites.

> > Dean insists that  the expected number of packets with  this attack is
> > actually 28 million. I think his math is suspect. See:
> 
> 28 million within what period of time?

It depends on how fast your link is. The numbers of interest are:

  - knowing the probability of guessing one query and the number
    of simultaneous queries you can stimulate, you can calculate the
    expected number of packets to have a 50% chance of success

  - knowing the expected number of packets, the size of the packets, and
    the speed of the link, you can calculate how long it will take you
    to send that many packets

-Peff