Full Disclosure mailing list archives
Re: DNS flaw fixing causes surge in DNS traffic
From: <Glenn.Everhart () chase com>
Date: Sat, 12 Jul 2008 13:59:14 -0400
The kind of thing being talked about should be perhaps viewed in terms of other work Dan has done. An exploit that alters DNS and is combined with turning corporate browsers into gateways is perfectly feasible and would in effect make most corporate gateways into pieces of wire. All the pieces are pretty much out there already, available to any of us who have grabbed them over the years. An exploit that also combines research into being able to scan loads of systems at once could be useful, even where the chance of success on a single site got down in the few percent range, in compromising substantial numbers of systems. Since DNS resolution is distributed, this could mean substantial sections of DNS resolution might be compromised at once, so that for example if you wanted to resolve mumble.foo.com, whereas perhaps the root DNS systems might get foo.com right, the foo.com resolver would give out evil-cracker.something's IP address instead of the real mumble.foo.com. Let this happen widely enough and chaos ensues. It need not only be for the denizens of foo.com, but could affect many others. Three orders of magnitude (or more) speedup of common processors makes quite a difference here. Remember we are using protocols designed when 56KB was the arpanet BACKBONE speed and was considered blindingly fast, and when computers with cycle times of 1 megahertz were common and considered reasonable performers. Back then, guessing 65K of something was not as trivial as now...and I rather suspect with a few recursive routing tricks enough sensing can be devised to cut that down, possibly with the birthday paradox, even attacking one site. But when was the last time Dan K. did an app that attacked only one? Attack 65000 at a time and the birthday paradox wins for the attacker bigtime. Mind I have no inside information about Dan's plans, but I read now and then.. :-) Glenn Everhart -----Original Message----- From: full-disclosure-bounces () lists grok org uk [mailto:full-disclosure-bounces () lists grok org uk]On Behalf Of n3td3v Sent: Friday, July 11, 2008 6:30 PM To: full-disclosure () lists grok org uk Subject: Re: [Full-disclosure] DNS flaw fixing causes surge in DNS traffic On Fri, Jul 11, 2008 at 10:54 PM, Supranamaya Ranjan <soups () narus com> wrote:
Hi, I noticed an interesting side-effect of the co-ordinated DNS patching after the news broke out on Tues July 8th. Some DNS servers started seeing more than normal amount of query traffic, most likely due to the fact that the patched DNS clients and resolvers had their caches reset and hence had to resolve new domains. More interestingly, all these clients began their new DNS resolutions around the same time. For more details please read the blog article at: http://www.narus.com/blog/2008/07/10/dns-fix-causes-huge-surge-in-dns-traffic-in-the-internet/ Thanks, Soups Ranjan
Stop adding to the media over hype FFS, its a gay bug being used to market Blackhat security conference, think about the timing of the announcement and media over hype carnage and say to yourself "Why now?". All the best, n3td3v _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ----------------------------------------- This transmission may contain information that is privileged, confidential, legally privileged, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is STRICTLY PROHIBITED. Although this transmission and any attachments are believed to be free of any virus or other defect that might affect any computer system into which it is received and opened, it is the responsibility of the recipient to ensure that it is virus free and no responsibility is accepted by JPMorgan Chase & Co., its subsidiaries and affiliates, as applicable, for any loss or damage arising in any way from its use. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format. Thank you. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- DNS flaw fixing causes surge in DNS traffic Supranamaya Ranjan (Jul 11)
- Re: DNS flaw fixing causes surge in DNS traffic n3td3v (Jul 11)
- <Possible follow-ups>
- Re: DNS flaw fixing causes surge in DNS traffic Glenn.Everhart (Jul 12)