Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: DNS Cache Dan Kamikaze (Actual Exploit Discussion)
From: Paul Schmehl <pschmehl_lists () tx rr com>
Date: Tue, 15 Jul 2008 19:40:17 -0500

--On July 16, 2008 2:14:42 AM +1000 Mark Andrews <Mark_Andrews () isc org> wrote:

--On Tuesday, July 15, 2008 09:14:39 +1000 Mark Andrews
<Mark_Andrews () isc org

>    And the best solution to this attack is to deploy DNSSEC.
>    You don't care where the response comes from provide the
>    signatures are good.

Except that DNSSEC is going to have to improve dramatically to achieve
widespread adoption.  Right now it's a PITA to understand and implement
and  then 30 days later you have to do it all over again.  Frankly,
it's not worth

the effort until the technology improves enough to make it easier to
implemen t
and maintain.

        Have you actually tried to sign a zone?
        Have you actually tried to re-sign a zone?

        Just use the defaults and don't try to control every aspect.

The real problem isn't signing or resigning zones, or even successfully completing the original configuration (although those are not trivial for the average person trying to setup their own dns). It's the trust anchors. Until the root is signed, trust anchors are a PITA. And until the root is signed, why should anyone believe that DNSSEC will achieve wide adoption?

Paul Schmehl
If it isn't already obvious,
my opinions are my own and not
those of my employer.

Attachment: _bin

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]