full-disclosure - Re: DNS Cache Dan Kamikaze (Actual Exploit Discussion)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <862584B6CE317CF0D503FF12@Macintosh.local>
Date: Tue, 15 Jul 2008 19:40:17 -0500
From: Paul Schmehl <pschmehl_lists@...rr.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: DNS Cache Dan Kamikaze (Actual Exploit
 Discussion)

--On July 16, 2008 2:14:42 AM +1000 Mark Andrews <Mark_Andrews@....org> 
wrote:

>
>> --On Tuesday, July 15, 2008 09:14:39 +1000 Mark Andrews
>> <Mark_Andrews@....org
>> >
>> wrote:
>>
>> > 	And the best solution to this attack is to deploy DNSSEC.
>> > 	You don't care where the response comes from provide the
>> > 	signatures are good.
>> >
>>
>> Except that DNSSEC is going to have to improve dramatically to achieve
>> widespread adoption.  Right now it's a PITA to understand and implement
>> and  then 30 days later you have to do it all over again.  Frankly,
>> it's not worth
>>
>> the effort until the technology improves enough to make it easier to
>> implemen t
>> and maintain.
>
> 	Have you actually tried to sign a zone?
> 	Have you actually tried to re-sign a zone?
>
> 	Just use the defaults and don't try to control every aspect.
>

The real problem isn't signing or resigning zones, or even successfully 
completing the original configuration (although those are not trivial for 
the average person trying to setup their own dns).  It's the trust 
anchors.  Until the root is signed, trust anchors are a PITA.  And until 
the root is signed, why should anyone believe that DNSSEC will achieve 
wide adoption?

Paul Schmehl
If it isn't already obvious,
my opinions are my own and not
those of my employer.

Content of type "application/pkcs7-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/