Re: okay already

On Tuesday, March 23, 2010 06:13 AM, Michael Loftis wrote:
>
>
> --On Monday, March 22, 2010 3:56 PM -0400 Dean Anderson <[email protected]>
> wrote:
>
>
>> It occurs to me that another effect of the King/Day/Kaminksy/Vixie
>> crack-to-make-forgery-consistent patch is that a slew of repeated
>> queries will be sent to different nameservers, not all of which might be
>> in the path. By limiting to one query, a successfull interception
>> in-path to one nameserver, the attacker is guaranteed to get all the
>> queries outstanding. The patch really does make cracking DNS consistent
>> and virtually undetectable.
>
> What you're totally missing, and have been totally misssing, and has
> been tried to explain to you, is that, unpatched, it's MANY orders of
> magnitude *easier* to get false data into the cache and propagated to
> users. And very few domains have 1 or 2 DNS servers, so you have to
> guess which one the system tries to contact as well. The patches greatly
> decrease the likelihood of a successful collision/birthday attack.
> Without the patches, it's trivial to get garbage data into the cache,
> and once it's in there, to convince the caching resolver to retain that
> garbage information. With the patches it takes a really large sustained
> attack to have any probability of inserting any rogue data into the DNS
> Cache.

Good thing one first has to muck about with the network packets and hope 
the routers allow the packets through or takeover a box within the 
dnscache's allowed network. Anyone running an open dnscache probably 
does not care about security anyway and it would have been firewalled 
after the first few rounds of hammering authoritative servers without 
the merge patch.


>
> Quit talking crap about things you don't understand, or worse, don't
> know anything about, it makes you appear really stupid.
>
>

And quit blowing up the 'ease' with which one can poison dnscache.