Re: DNS Speculation

["Tyler Krpata" <krpatasec () gmail com>]

> I've been trying to understand the attack, but I am not sure that I really get
> it. It looks like the only way it would work is if the DNS resolvers accept
> records they didn't ask for. Do they? If they do, why?

They do, for "in-bailiwick" records.

http://homepages.tesco.net/J.deBoynePollard/FGA/dns-server-bailiwick.html
http://cr.yp.to/djbdns/notes.html#gluelessness
http://www.faqs.org/rfcs/rfc1034.html

So the idea is that you are providing a correct, in-bailiwick
response, and you don't have to worry about beating the legit response
for the record you're trying to spoof into cache, since your spoofed
glue record is never seen until the spoofing attempt is successful.
The innovative thing about this attack, as far as I can see, is that
you don't have to actually care about successfully spoofing the Answer
section for any particular response.
_______________________________________________
Dailydave mailing list
Dailydave () lists immunitysec com
http://lists.immunitysec.com/mailman/listinfo/dailydave