|
| View previous topic :: View next topic |
| Author |
Message |
jebba
|
 Posted: Wed Jul 09, 2008 6:50 am Post subject: DNS Bug |
 |
|
http://media.blackhat.com/webinars/blackhat-kaminsky-dns-press-conference.mp3
Seems to be something like this:
| paul vixie in 1995 wrote: | | With only 16 bits worth of query ID and 16 bits worth of UDP port number, it's hard not to be predictable. A determined attacker can try all the numbers in a very short time and can use patterns derived from examination of the freely available BIND source code. Even if we had a white noise generator to help randomize our numbers, it's just too easy to try them all. |
| djb 2001 wrote: | > Randomising the port number for each query achieves precisely nothing.
Wrong. Randomizing the port number makes a huge difference in the cost
of a forgery for blind attackers---i.e., most attackers on the Internet.
Here's the picture:
| Code: | normal colliding sniffing
blind attack blind attack attack
------------ ------------ --------
nothing 1 1 1
ID (BIND) 65536 256 1
ID+port (djbdns) 4227727360 65020 1 |
It's funny that the BIND company has gone to so much effort to move from the first line to the second, but now pooh-poohs the third line. |
|
|
|
 |
john maclean
|
| Posted: Wed Jul 09, 2008 9:34 pm Post subject: |
|
|
http://www.doxpara.com/
FWIW.
Look on the right hand side of the page for the "dns checker". Ran the test on a 70k laptop with no firewall - safe(?).
|
_________________
BLAG 'em up! |
|
|
jebba
|
| Posted: Wed Jul 09, 2008 10:23 pm Post subject: |
|
|
| john maclean wrote: | http://www.doxpara.com/
FWIW.
Look on the right hand side of the page for the "dns checker". Ran the test on a 70k laptop with no firewall - safe(?). |
It is checking your *ISP*, not your BLAG box.
|
|
|
|
john maclean
|
| Posted: Wed Jul 09, 2008 10:46 pm Post subject: |
|
|
right. Yeah I knew that /* lies */
|
_________________
BLAG 'em up! |
|
|
jebba
|
|
|
jebba
|
| Posted: Thu Aug 07, 2008 12:40 am Post subject: |
|
|
Test the DNS resolver you are using (as listed in /etc/resolv.conf):
| Code: | | dig +short porttest.dns-oarc.net TXT |
|
|
|
|
jebba
|
|
|
jebba
|
|
|
|
|
|
