Re: "djbdns and nxdspecial patch"

On Mon, 26 Apr 2010, Dean Anderson wrote:
> > djbdns is secure from this type of exploit?
> 
> Yes. It takes millions of packets to get a successful exploit, making
> this attack impractical. However, with stock djbdns 1.05, one would
> still have an opportunity to notice the inconsistent responses. By
> checking the logs, one can discover that something was wrong, and
> discover what the right answer actually was.
> 
> The King/Day/Kaminsky patches eliminate any inconsistent responses and
> thereby prevent the discovery of a successful attack.

The King/Day/Kaminsky patches are worse than I describe above. They also
affect the case where the attacker is in the path to one (but not all)  
of the authority servers. A few quickly repeated queries are common in
Windows and Unix during login.  Djbdns-1.05 will likely send queries to
each of authority servers.  If the attacker can intercept one, but not
all, then the client will get inconsistent responses back, and detect an
anomaly with djbdns-1.05. No anomaly will be reported using the
King/Day/Kaminsky patches.



			--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 256 5494