FAQ   Search   Memberlist  
Profile    Log in to check your private messages    Register    Log in
DNS Bug

 
Post new topic   Reply to topic    BLAG Forum Index -> politics
View previous topic :: View next topic  
Author Message
jebba
PostPosted: Wed Jul 09, 2008 6:50 am    Post subject: DNS Bug Reply with quote

http://media.blackhat.com/webinars/blackhat-kaminsky-dns-press-conference.mp3

Seems to be something like this:

paul vixie in 1995 wrote:
With only 16 bits worth of query ID and 16 bits worth of UDP port number, it's hard not to be predictable. A determined attacker can try all the numbers in a very short time and can use patterns derived from examination of the freely available BIND source code. Even if we had a white noise generator to help randomize our numbers, it's just too easy to try them all.


djb 2001 wrote:
> Randomising the port number for each query achieves precisely nothing.

Wrong. Randomizing the port number makes a huge difference in the cost
of a forgery for blind attackers---i.e., most attackers on the Internet.
Here's the picture:

Code:
                     normal         colliding      sniffing
                     blind attack   blind attack   attack
                     ------------   ------------   --------
   nothing           1              1              1
   ID (BIND)         65536          256            1
   ID+port (djbdns)  4227727360     65020          1


It's funny that the BIND company has gone to so much effort to move from the first line to the second, but now pooh-poohs the third line.

john maclean
PostPosted: Wed Jul 09, 2008 9:34 pm    Post subject: Reply with quote

http://www.doxpara.com/
FWIW.
Look on the right hand side of the page for the "dns checker". Ran the test on a 70k laptop with no firewall - safe(?).


_________________
BLAG 'em up!
jebba
PostPosted: Wed Jul 09, 2008 10:23 pm    Post subject: Reply with quote

john maclean wrote:
http://www.doxpara.com/
FWIW.
Look on the right hand side of the page for the "dns checker". Ran the test on a 70k laptop with no firewall - safe(?).


It is checking your *ISP*, not your BLAG box.

john maclean
PostPosted: Wed Jul 09, 2008 10:46 pm    Post subject: Reply with quote

right. Yeah I knew that /* lies */

_________________
BLAG 'em up!
jebba
PostPosted: Wed Jul 23, 2008 12:19 am    Post subject: Reply with quote

Details of DNS Flaw Leaked; Exploit Expected by End of Today

http://blog.wired.com/27bstroke6/2008/07/details-of-dns.html

jebba
PostPosted: Thu Aug 07, 2008 12:40 am    Post subject: Reply with quote

Test the DNS resolver you are using (as listed in /etc/resolv.conf):

Code:
dig +short porttest.dns-oarc.net TXT

jebba
PostPosted: Thu Aug 07, 2008 7:10 am    Post subject: Reply with quote

Starts hitting mainstream press...
http://voices.washingtonpost.com/securityfix/2008/08/kaminsky_details_dns_flaw_at_b.html?nav=rss_blog

jebba
PostPosted: Fri Aug 08, 2008 9:53 pm    Post subject: Reply with quote

An Illustrated Guide to the Kaminsky DNS Vulnerability

http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.html

Display posts from previous:   
Post new topic   Reply to topic    BLAG Forum Index -> politics
Page 1 of 1

Protected by Anti-Spam ACP