Re: first succesful (lab) spoof of a fully source port randomized server reported

[Alex Bligh <[e-mail]>]

--On 10 August 2008 09:37:18 +0200 [e-mail] wrote:

> The attacker needs to spoof a *specific* source IP. The 1M node botnet
> doesn't help here. As Paul Vixie said on bind-users today:

Let's suppose the attacker /does/ spoof a specific source IP (or a small
group thereof), and uses it to target servers configured like this...

>> note that any dns server with a host based firewall can implement a 100%
>> effective mitigation for the Polyakov attack, and it's possible that an
>> upstream/outboard firewall could also be made to do it.  in freebsd ipfw
>> it looks like this:
>>
>> add     pipe 1  udp     from any 53 to 204.152.188.20 in
>> pipe 1  config  mask src-ip 0xffffffff buckets 32768 bw 56Kbit/s queue 1
>
> which is exactly what I was thinking of.

...I think we've just succeeded in converting a poisoning attack into
a DoS vector. Just spoof the IPs of the root nameservers, or NS for
google.com or whatever. I realise DoS of root nameserver access is probably
less dangerous that poisoning then, but...

Alex

--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>