Re: distributed.net and seti@home

[robertw () WOJO COM (Robert Wojciechowski Jr.)]

> ----- Original Message -----
> From: Bryce Walter [SMTP:brycewalter () HOTMAIL COM]
> Reply To:     Bryce Walter [SMTP:brycewalter () HOTMAIL COM]
> Sent: Monday, January 31, 2000, 0:28:59
> To:   VULN-DEV () SECURITYFOCUS COM
> Subject:      Re: distributed.net and seti@home
>
> In theory its not too difficult to provide false dns info.
> -Identify the dns server for the target machine.
> -Issue a query to that dns server for the name you wish to provide    the
> wrong IP address for.
> -Send a spoofed dns query reply that appears to be from the upstream dns
> server with the false data that you want.

And with something like 30% of the name servers on the Internet vulnerable
to DNS spoofing (read this somewhere, I think quickdns.com), the chances you
or your upstream DNS providers having a spoofable DNS server is pretty high.

Robert S. Wojciechowski Jr.
robertw () wojo com