bugtraq - Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <26162adb0707241307v62e5cfa2w38f949f558dc2034@mail.gmail.com>
Date: Tue, 24 Jul 2007 23:07:59 +0300
From: "Amit Klein" <aksecurity@...il.com>
To: "securityfocus@...workontap.com" <securityfocus@...workontap.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

1. The URL you provided doesn't mention any analysis of BIND.

2. You probably refer to a different, later article titled "DNS Cache
Poisoning - The Next Generation", by LURHQ Threat Intelligence Group
(http://www.lurhq.com/cachepoisoning.html).

3. You may have noticed that both papers are in fact referenced in my
paper, as [8] and [9], respectively.

4. Also, the paper clearly outlines the novelty in the introduction
section. The attractors method, as described in LURHQ's paper,
requires sending 5000 forged responses, and is guaranteed to succeed
only 20% of the time. In the new paper, a method is described in which
by sending 1-10 responses, the attack is guaranteed to succeed (100%).
All this of course given standard conditions. The paper also details
why sending 5000 responses is way less feasible than sending 10 (ini
terms of likelihood to get to the target server before the gebuine
response does).

-Amit

On 24 Jul 2007 17:40:35 -0000, securityfocus@...workontap.com
<securityfocus@...workontap.com> wrote:
> I don't exactly see how this is new "News" since Zalewski's paper on TCP sequence number analysis (which included analysis of versions of BIND):
>
> http://lcamtuf.coredump.cx/newtcp/
>
> -ntn
>
>