mailing list archives
Re: Nominate Dan Kaminsky for Most Overhyped BugPwnie Award
From: imipak <imipak () gmail com>
Date: Wed, 23 Jul 2008 16:29:23 +0100
Given how easy it appears to be to redirect a client to a malicious web server,
The web != the Internet.
Think of POP and IMAP.Hmmm.
All those Cisco devices that still use telnet rather than Ssh...
I'm /sure/ there are no SP networks whose routers don't use BGP + MD5
*and* which use unpatched or NAT'd DNS servers. Why, that's just crazy
There's still no patches (or anything else) from Checkpoint, Cisco, or
any other vendors of vulnerable NATs, AFAIK, though Vixie and Dan
Kaminsky have both said CERT are working on it.
At http://blog.wired.com/27bstroke6/2008/07/kaminsky-on-how.html , Dan
is quoted saying:
Q: How far along are people in patching the DNS servers? Do
you know how many have been patched?
DK: [...] We were getting some pretty good pickup on
this patch. The last time I looked at people who were testing
against my site it was somewhere in 30 to 40 percent ...
Is it 22:58 already?
make way for history
flickering like a long-lost memory
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/