Re: [Crisp] IRIS-LWZ and security issues due to spoofed sources

On Mon, 27 Feb 2006, William Leibzon wrote:

> On Mon, 27 Feb 2006, Andrew Newton wrote:
>> 
>> On Feb 27, 2006, at 8:08 AM, Shane Kerr wrote:
>> 
>>> Since this is a general UDP problem, perhaps it makes sense to point to
>>> another document for this problem. Is there such a thing?
>> 
>> That was gonna be my first question:  just how do they mitigate this with 
>> DNS?  Or DHCP?  Or anything else that uses UDP?
>
> They don't deal with it very well. But there are actually only few protocols
> to which it is applicable since most protocols that use UDP would do it for
> things like creating a data stream that is not subject to TCP retransmission.
> In those cases real transmission does not begin until response is received
> from originator - i.e. they simulate TCP in a way and do create a sort of
> a session before larger amount of data is sent.
>
> Where it is applicable is one-query request/response protocols which are
> only few (most use TCP) such as DNS and DHCP. For DHCP the solution is 
> simply that DHCP servers only  respond to requests from within local 
> lan and not to whole world. For dns there is no good solution that 
> everyone likes - hence current set of discussions on how to deal with 
> this issue at operational mail lists.

Just so you know - in dns the recursion is being used as a way to cause 
responder to send back large data where it would normally not have done
it (this is kind-of poisoning) as there are only few sites that have 
large dns records and are good amplification potential as-is [this 
reminds me that I need to bring this issue up on DKIM since it is
going to introduce large dns records which as I said many times is
really not a good thing to have].

---
William Leibzon
   mailto: william@completewhois.com
Anti-Spam and Email Security Research Worksite:
   http://www.elan.net/~william/emailsecurity/
Whois & DNS Network Investigation Tools:
   http://www.completewhois.com

_______________________________________________
Crisp mailing list
Crisp@ietf.org
https://www1.ietf.org/mailman/listinfo/crisp