Re: "djbdns and nxdspecial patch"

On Fri, 23 Apr 2010, Marco wrote:
> Ok Dean, but the kaminsky bug in djbdns-1.05 exist or not?

It is Not vulnerable.  It takes millions of packets to spoof
djbdns-1.05. So while theoretically possible, its not a practical attack
on djbdns-1.05.  This birthday attack was first analyzed around 2002.  
http://www.kb.cert.org/vuls/id/457875 Note that it takes at most 32000
packets to get a 50% success rate on BIND. This fact (the vulnerability
in BIND) was known long before 2002, and was the raison d'et for the
creation of djbdns in the 1990s. Vixie and mafia silenced Bernstein's
discussion of the BIND vulnerability and silenced the obvious fix of
port randomization. So Bernstein wrote djbdns.  All other DNS 
software except BIND implemented port randomization by 2006. After that, 
BIND stood alone and vulnerable. 

> http://www.linuxjournal.com/content/understanding-kaminskys-dns-bug

The article you quote is one of the first publications during the hoax,
which was perpetrated in June/July 2008.  The first publication to 
note the hoax was the December 2008 MIT Technology Review.

The hoax is that all the facts cited by the article (and by Kaminsky et
al) were already known long before July 2008.

The financial scam is that Kaminsky and Vixie tried to scare people to
change to OpenDNS or a new version of BIND.

> djbdns is secure from this type of exploit?

Yes. It takes millions of packets to get a successful exploit, making
this attack impractical. However, with stock djbdns 1.05, one would
still have an opportunity to notice the inconsistent responses. By
checking the logs, one can discover that something was wrong, and
discover what the right answer actually was.

The King/Day/Kaminsky patches eliminate any inconsistent responses and
thereby prevent the discovery of a successful attack.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 256 5494