Re: Exploit for DNS Cache Poisoning - RELEASED

[Mike Lewinski <mike () rockynet com>]

Joe Greco wrote:

> So, I have to assume that I'm missing some unusual aspect to this attack.
> I guess I'm getting older, and that's not too shocking.  Anybody see it?

AFAIK, the main novelty is the ease with which bogus NS records can be 
inserted. It may be hard to get a specific A record 
(www.victimsbank.com) cached, but if you can shim in the NS records of 
your ns.poisoner.com authority, then getting the real target A record is 
trivial since you'll be asked directly for it (and can wait for the 
legit clients to ask for it for you).

Mike