Re: djbdns: Current recommended patches?

Jeff King <[email protected]> wrote:
> On Fri, May 22, 2009 at 03:38:49AM -0400, Paul Jarc wrote:
>> So the problem only comes when the attacker doesn't have that option -
>> say, they can roughly predict when there will be queries for
>> target.example.com, but not for other.example.com (implying that they
>> are unable to trigger such queries themselves), and they don't want to
>> send a continuous stream of forgeries all the time since that's more
>> likely to be detected.  Let's assume the attacker is working under
>> these restrictions.
>
> I'm not sure that type of poisoning is actually practical. If I wait for
> you to query target.example.com and then try to poison it, I have a very
> small window to guess before the correct answer gets cached.  Kaminsky
> poisoning only works because you can just keep trying over and over with
> no wait.

Ah, right.  Dean mentioned using a DOS attack to derail the outgoing
query or the genuine response, which would help some, but not as much
as being able to try again.

> MAXTCP shouldn't be a problem. It is a cap on the number of _incoming_
> TCP queries to dnscache.

Ok, I see that now.


paul