Re: Quick Poll: Would you trust system software from an anonymous source?

On Thu, 11 Mar 2010, Paul Jarc wrote:

> Dean Anderson <[email protected]> wrote:
> > On Thu, 11 Mar 2010, Paul Jarc wrote:
> >> That section describes sending a forged NXDOMAIN response to fool a
> >> cache into thinking the QNAME does not exist.  It doesn't mention
> >> anything about iterating through multiple QNAMEs to get better odds of
> >> poisoning through glue.
> >
> > It talks about spoofing NXDomain responses, which you obviously get by
> > steping through QNAMEs that don't exist.
> 
> The attack described in the RFC, as its primary goal, makes a
> geniuinely existing domain seem to not exist.  

By spoofing NXdomain replies, alerting us to NXDomain spoofing.

> Kaminsky's attack queries for names that probably don't exist, but if
> they happen to, the attack still works just as well (and the forged
> answers may or may not be NXDOMAIN, without affecting the result),
> with the goal of poisoning an unrelated name.  These are not at all
> alike.

If the records happen to exist, then its just like the RFC described as
example:  Spoofing wrong NXdomain is possible. But If they don't exist,
then spoofing NXDomain is still possible. We knew that before.

  We knew NXdomain spoofing was possible
  We knew bad glue was possible.

Putting them together isn't a discovery.

The Cache poisoning attack wasn't any more likely or any more harmful
than it was known to be in 2006. It took 26 million packets in January
2008 to spoof dnscache. It takes 26 million packets to spoof dnscache
now.  There was no (non-gratuitous) change and no discovery.

> > The particular case of spoofing glue was something people tested for in
> > 2006 and before. It was known then exactly what the problems spoofing
> > glue caused.
> 
> Right.  I'm not claiming that part was novel.  As far as I know, Dan
> hasn't claimed that either.

No part of it was novel.  We knew all this beforehand.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 256 5494