Re: first succesful (lab) spoof of a fully source port randomized server reported

[Jeroen Massar <[e-mail]>]

[e-mail] wrote:
>> http://tservice.net.ru/~s0mbre/blog//devel/networking/dns/2008_08_08
>>
>> "Attack took about half of the day, i.e. a bit less than 10 hours.
>>  So, if you have a GigE lan, any trojaned machine can poison your DNS during
>>  one night... "
>>
>> Congratulations are due to Evgeniy Polyakov! He includes the source of his
>> exploit.
> 
> Interesting enough. Meanwhile, if I have a recursive name server where
> the total traffic from the authoritative servers is in the range of
> 2 - 3 Mbps, I believe I could safely rate limit the traffic from each
> individual IP (representing a possibly spoofed authoritative server) to
> 100 - 200 kbps. This should raise the bar somewhat.

/me reconfigures the 1M-node botnets to only send 100 packets/s per bot.

Isn't distributed^Wcloud computing amazing?

Unfortunately, as long as one can try all the combinations in one way or 
another the problem keeps on existing. And if people can send 1G for 12 
hours without nobody noticing, you have worse problems in your network.

Bad part is that one can most likely also crack dnssec or tls in this 
method, it basically is the infinite monkeys typing problem, they will 
produce the answer that you expected. If you work against it, eg "the 
monkeys send me X fake responses lets ratelimit" you might be blocking 
service (denial of service) to something legit again.

Nice and annoying problem, thanks Dan* :)

Greets,
  Jeroen

* = do the dictionaries already contain a proper definition for "to pull 
a Kaminsky on someone"? :)