Comments on: DNS cache poisoning http://angelsofsecurity.com/blog/2008/07/25/dns-cache-poisoning/ Musings of an infosec renegade Tue, 19 Jul 2011 19:43:52 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: admin http://angelsofsecurity.com/blog/2008/07/25/dns-cache-poisoning/comment-page-1/#comment-896 admin Thu, 28 Aug 2008 19:43:47 +0000 http://angelsofsecurity.com/blog/2008/07/25/dns-cache-poisoning/#comment-896 DNS is one of the older protocols around, and it is somewhat fatally flawed (the first response wins is just not a good idea). I agree that it will probably need an overhaul eventually. As for turning off recursive queries, most DNS requests and responses should generate IP packets that aren't much more than 100 bytes. Even if you throw on a little more space for the lower level headers (Ethernet, 802.11, or whatever you're using), and it's still not very much traffic. Yes there will be a slight delay as the functionality is being moved from the (theoretically faster) DNS server to the end-user, but it will most likely be measured in nanoseconds, if that. DNS is one of the older protocols around, and it is somewhat fatally flawed (the first response wins is just not a good idea). I agree that it will probably need an overhaul eventually.

As for turning off recursive queries, most DNS requests and responses should generate IP packets that aren’t much more than 100 bytes. Even if you throw on a little more space for the lower level headers (Ethernet, 802.11, or whatever you’re using), and it’s still not very much traffic. Yes there will be a slight delay as the functionality is being moved from the (theoretically faster) DNS server to the end-user, but it will most likely be measured in nanoseconds, if that.

]]> By: Matt W. http://angelsofsecurity.com/blog/2008/07/25/dns-cache-poisoning/comment-page-1/#comment-891 Matt W. Thu, 28 Aug 2008 03:16:14 +0000 http://angelsofsecurity.com/blog/2008/07/25/dns-cache-poisoning/#comment-891 While turning off recursive queries within an organization (really, their name servers) may resolve a piece of the issue - this flaw exists in the foundations of DNS (your query ID for a lookup is effectively your password and it's a race to respond with the proper query ID... between the proper authoritative name server and the attacker "name" server). Plus, how will you disable recursive queries for ISP name servers (Comcast, Verizon, etc.) - I would suppose this would require the client to perform each lookup (as in, everyones PC) - since the ISP name server wouldn't be doing the heavy lifting. With home user's performing all the lookups directly, network utilization would increase by a non-trivial amount due to the additional DNS traffic overhead (at least, I would think so... otherwise, why have recursion and caching in the first place). I think the patches solve this issue in the near term, in the long run DNS probably needs an overhaul (much like IPv4 did), but judging by the adoption rate of IPv6, I wouldn't hold my breath. Now get ready for this BGP issue to take off like wild fire... While turning off recursive queries within an organization (really, their name servers) may resolve a piece of the issue – this flaw exists in the foundations of DNS (your query ID for a lookup is effectively your password and it’s a race to respond with the proper query ID… between the proper authoritative name server and the attacker “name” server). Plus, how will you disable recursive queries for ISP name servers (Comcast, Verizon, etc.) – I would suppose this would require the client to perform each lookup (as in, everyones PC) – since the ISP name server wouldn’t be doing the heavy lifting. With home user’s performing all the lookups directly, network utilization would increase by a non-trivial amount due to the additional DNS traffic overhead (at least, I would think so… otherwise, why have recursion and caching in the first place). I think the patches solve this issue in the near term, in the long run DNS probably needs an overhaul (much like IPv4 did), but judging by the adoption rate of IPv6, I wouldn’t hold my breath. Now get ready for this BGP issue to take off like wild fire…

]]>