mailing list archives
Re: DNS Cache Dan Kamikaze (Actual Exploit Discussion)
From: Paul Schmehl <pschmehl_lists () tx rr com>
Date: Tue, 15 Jul 2008 10:47:28 -0500
--On Tuesday, July 15, 2008 09:14:39 +1000 Mark Andrews <Mark_Andrews () isc org>
And the best solution to this attack is to deploy DNSSEC.
You don't care where the response comes from provide the
signatures are good.
Except that DNSSEC is going to have to improve dramatically to achieve
widespread adoption. Right now it's a PITA to understand and implement and
then 30 days later you have to do it all over again. Frankly, it's not worth
the effort until the technology improves enough to make it easier to implement
I know you don't want to hear that, but that's the truth.
As if it wasn't already obvious,
my opinions are my own and not
those of my employer.
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/