bugtraq - Re: International DNS compromise?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <200408062036.i76Ka4Eh017235@plug.fi>
Date: Fri, 6 Aug 2004 13:36:04 -0700 (PDT)
From: "Troy" <tjk@...oft.com>
To: nocmonkey@...il.com (Danny)
Cc: tjk@...oft.com (Troy K.), zhenshi99@...oo.com (Zhen Shi),
	bugtraq@...urityfocus.com
Subject: Re: International DNS compromise?


Caching DNS (i.e. doing transparent proxying for DNS) means 
that the ISP intercepts all DNS traffic. The caching you refer
to only applies when users are using the ISP's name servers.

I don't know of any ISP who would be intercepting DNS queries.

When you use nslookup and specify a server, the query is sent directly
to the server you specify, not the name server of your ISP.

Cheers,


Troy


> 
> On Thu, 5 Aug 2004 10:49:39 -0700 (PDT), Troy <tjk@...oft.com> wrote:
> > It's probably the ISP you are using.
> > They are intercepting DNS requests and returning their
> > own replies. It could be something malicious, but it could
> > just as well be the ISP saving bandwidth by caching DNS queries.
> 
> I have never heard of an ISP which does not cache (Bind does by
> default) DNS queries. If they did not, their DNS servers would be
> constantly hitting the root servers, which would be horribly
> inconsiderate.
> 
> > If they cache DNS queries they probably cache www queries as
> > well. 
> 
> See my last comment.
> 
> ...D
>