Full Disclosure mailing list archives
Re: Re DNS spoofing issue discussion
From: Paul Schmehl <pschmehl_lists () tx rr com>
Date: Thu, 31 Jul 2008 22:37:20 -0500
--On July 31, 2008 9:17:00 PM -0600 don bailey <don.bailey () gmail com> wrote:
The BGP fixes were devised after the last meltdown, but question again is whether they are installed. If DNSSEC had been installed, Kaminsky's issue would not exist.That's probably not the case. It would only alter the scope of attack to include encryption and not simply port+xid. Since UDP is stateless one could could have theoretically kicked off some semblance of brute force attack against the key used for encryption. For algorithms that use bits larger than would be feasible for brute force attacks, the latest SNMPv3 vulnerability comes to mind, as does Tim Newsham's attack on WEP. In other words, there are always options. The attack wouldn't have gone away. As they say, there are 1,000,000 ways to get to Detroit.
Apples and oranges. *Attacks* will never go away, but dnssec, if fully implemented, would render Dan's attack moot. Unless you've factored 256 bit RSA keys, in which case you should be making six figures.
Paul Schmehl If it isn't already obvious, my opinions are my own and not those of my employer.
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re DNS spoofing issue discussion Mary and Glenn Everhart (Jul 31)
- Re: Re DNS spoofing issue discussion don bailey (Jul 31)
- Re: Re DNS spoofing issue discussion Paul Schmehl (Jul 31)
- Re: Re DNS spoofing issue discussion don bailey (Jul 31)
- Re: Re DNS spoofing issue discussion Paul Schmehl (Jul 31)
- Re: Re DNS spoofing issue discussion don bailey (Jul 31)
- Re: Re DNS spoofing issue discussion Paul Schmehl (Jul 31)
- Re: Re DNS spoofing issue discussion don bailey (Jul 31)