Re: Dishonest Forks? | Was - Re: [Namedroppers-honest] Brian Smith asks: Who is Dean Anderson?

--On Thursday, March 11, 2010 9:02 AM -0700 Michael Loftis 
<[email protected]> wrote:

> I have actually.  There's been noone but yourself claiming it was a hoax,
> here, or anywhere that I can find, which is why I've asked you to cite
> any sort of reference.  Further, it isn't a hoax.  I've seen BIND and
> dnscache cache's poisoned by this method in the wild.  There are
> mitigating factors and in order to have a chance of success requires a
> number of things (such as no reverse path filters/spoof filters in place
> on the nefarious client/attacker, or between the nefarious
> client/attacker and the resolver, and it helps to have a relatively
> healthy uplink).  But in the places it's possible, it's rather quite
> trivial to get it to happen.  The trick is that you only need one answer
> to win the race, worse, if you fail a race, you just change the A record
> you're using to push poisoning onto the cache.  So you go first try
> alice.example.com, send a few hundred requests for that, while spoofing
> responses, if (and when) you get a response from the resolver to your
> question and it's not your spoofed response, you move on to say
> bob.example.com, and keep trying.  alice and bob don't even have to exist
> in the target domain for this one.  And only one spoofed packet (of
> easily many many thousands, or perhaps millions if you've a big enough
> uplink pipe towards the resolver) has to match the randomized bits of the
> packet information.
>

Further mitigating factors for the "Kaminsky-class" attacks in the wild are 
number of NS records, the more NS records for the target domain, the more 
potential sources you have to spoof to get a reply to the right question by 
the DNS resolver if the resolver validates the sender when it receives the 
answer.  If the resolver always asks every nameserver it knows about for a 
given target domain every time it encounters starts a new query then this 
mitigating factor becomes moot.  Another mitigating factor is that the 
resolver could send the question packet via a completely different IP -- 
this could be discovered though by the attacking agent by having a 
controlled nameserver and sending/watching for specific queries.