full-disclosure - DNS forward only: why does it help?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 24 Jul 2008 07:28:15 +1000
From: Paul Szabo <psz@...hs.usyd.edu.au>
To: full-disclosure@...ts.grok.org.uk
Subject: DNS forward only: why does it help?

As a workaround, it is recommended to set DNS servers to forward only.
Can someone explain why that helps? Cannot responses from the forwarder
be spoofed same as normal query responses? Is it that "glue RRs" from
forwarders are discarded; or that source ports of forwarded requests are
better randomized than normal queries; or that forwarding is done with
TCP not UDP?

The "published attack" has ns.victim.com spoofed. That does not affect a
server set to forward only. Could the attacker spoof login.victim.com
directly, and would not that affect a forward only server equally?

Thanks,

Paul Szabo   psz@...hs.usyd.edu.au   http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics   University of Sydney    Australia

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/