Attack Code Published For DNS Vulnerability 205
get_Rootin writes "That didn't take long. ZDNet is reporting that HD Moore has released exploit code for Dan Kaminsky's DNS cache poisioning vulnerability into the point-and-click Metasploit attack tool. From the article: 'This exploit caches a single malicious host entry into the target nameserver. By causing the target nameserver to query for random hostnames at the target domain, the attacker can spoof a response to the target server including an answer for the query, an authority server record, and an additional record for that server, causing target nameserver to insert the additional record into the cache.' Here's our previous Slashdot coverage."
Here we go... (Score:4, Interesting)
This has to be the worst time ever to be a web surfer. How long until we see the major networks broadcasting the legit IP quads of sites we want to reach?
Re:Here we go... (Score:5, Informative)
There's nothing new about this. DNS cache poisoning attacks have been found before, and the internet hasn't melted down yet. If you're paranoid, run your own caching resolver.
Re:Here we go... (Score:5, Interesting)
You may still not be safe. If someone can fire off a XSS attack through your browser, it could do enough lookups to make you vulnerable. Combine this with a periodic other run to a controlled server to grab your source port for guessing (presuming that you have not patched), and you may have a problem.
Granted, it's unlikely that you would explicitly be targeted, and things like NoScript help defend against it, but there are still possible gaps. In fact, there are several tens of million of systems which will remain vulnerable for some time to come; I haven't seen many SOHO router firmware fixes released so far, and a lot of people point to their routers for their DNS.
Re: (Score:3, Informative)
Re:Here we go... (Score:5, Informative)
Where I work, we run the servers through a proxy firewall with a DNS proxy service, and the DNS service on the firewall has been patched for this vulnerability. For traffic run through it, it doesn't preserve source port from the DNS servers, and from a quick glance, the source ports on requests seem to be randomized, so I think from that perspective, we may well be safer even for unpatched servers. However, our setup seems to be the exception, and we may have a couple of other networks (physically and logically separated from the primary) that do not have the benefits of this arrangement.
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:3, Informative)
You can run your own recursive resolver which only talks to authoritative DNS servers. You can configure it to use random source ports if you want to make this attack much more difficult. Then an attacker would have to send you billions of spoofed packets to poison your DNS. That seems a little excessive for exploiting just one user. You could make it even more difficult by rate limiting your resolver (you're its only user after all).
Re:Here we go... (Score:5, Insightful)
Yes, there was. Before there was bailiwick filtering, spoofing was even easier. Back in the days, DNS servers would even accept "responses" with bogus data out of the blue. We've come a long way and we don't stop here. A patch of bad weather is ahead, but the sky is not falling.
Re:Here we go... (Score:4, Insightful)
I guess this is just a wake up call that if you find such large flaws in network systems that could possibly affect millions, if not billions of users, that you should try to get the word out and get the products fixed beforehand.
Re: (Score:2)
Re: (Score:3, Informative)
Re:Here we go... (Score:5, Informative)
Different vulnerability, that tool checks for non-random TXID, not this exploit.
This exploit changes the game in letting other exploits work well.
It's not so much a new class of attack, as a way to give you infinite chances to use the old attacks. If you don't have a IPS checking for this, an attacker who can submit recursive queries to your resolver and wants to poising your DNS will eventually be successful. Publicly available tools work in one minute, Dan says coding in C on a fast connection he's able to do it in 10 seconds.
Has DNS been broken this badly before? Yes, multiple times. However, the will and knowledge of how to use DNS cache poising for further evil is much higher now then it was in the past. Also, we are becoming increasingly dependent on the Internet, and attacks on the infrastructure do more then just keep us from our news sites.
As Dan says, "Patch. Today. Now. Yes, stay late."
Re: (Score:2)
Re:Here we go... (Score:4, Informative)
Yes - go read Amit Klein's papers on trusteer.
Sending only a handful of more carefully calculated responses is also more likely to succeed if the victim is using mitigation techniques such as rate throttling.
Even using source port randomization doesn't help as much as a lot of people think. You don't get one 32-bit PRNG, you get 2x 16-bit PRNGs. Each of these can be attacked separately. If you could narrow each of these down to 10 likely guesses, you only have to send 100 replies.
Re: (Score:2)
Re: (Score:3, Informative)
The best known unpatched attacks really had no upper bound. You got one chance to attack, then had to wait for the records to timeout before you could try again.(usually set from 1 hour to 1 week, depending on the service)
What this vulnerability does is give you infinite chances to attack with no delay, so you can try 1000 times a second if your connection is fast enough. If you can do that, you will win, and quickly.
The attacks themselves have not really changed, we can just use them much faster.
Re: (Score:3, Insightful)
This has to be the worst time ever to be a web surfer.
Ummm... No. Today I can easily surf the 'net with just about every ad blocked, have Flash blocked when I want it to, but re-enable it for say, YouTube, all at the click of a mouse. I can use an OS and browser that is free and open source. I can surf 100% anonymously easily. I can download every video game I played as a child in less than an hour. And I can hear just about any song I ever would want to hear in less than a minute.
Sure, some things suck today, BT throttling, the ISP's "No-Usenet" crusade
Re:Here we go... (Score:5, Funny)
"And I can hear just about any song I ever would want to hear in less than a minute."
Shit, you should check out some of the songs that are longer than a minute, there's some good ones out there, but, yes...those quick little punk ditties are good too.
Re: (Score:3, Funny)
Re:Here we go... (Score:5, Interesting)
lol... you should try it, then you wouldnt think so... I just did (in Sound Forge)... cut it down to 1:08, its just noise... cutting it down to 50% is alright though (4:35)... but somewhere around 65% (5:57) is about right, sounds kinda "proper".
Re: (Score:2)
Wow that is...
*head-desk* Whoa, uhm. What was I going to post? *looks at winamp* Why was I playing Freebird?
Re:Here we go... (Score:5, Funny)
kthxbye
Re: (Score:3, Interesting)
You made me laugh, but as with all humour there is a grain of truth within.
Curiously I spent some time yesterday attempting to estimate the number of zones currently known to DNS. Perhaps there is a better approach ( one that, say, inquires against DNS ) but by using Teh Googler to search for site:.${TLD} I came up with these order-of-magnitude results:
These numbers just seem insane. Can anyone advise?
Re: (Score:3, Informative)
Re:CONFIRMED: Steve Jobs has AIDS !! (Score:4, Funny)
Re: (Score:2, Funny)
The idea of /b/ spreading outside of 4chan terrifies me more than the thought that my DNS might get hijacked, TBH.
Google (Score:5, Funny)
The Book Of Internets, Chapter Three, Verse Twelve (Score:5, Funny)
Re:The Book Of Internets, Chapter Three, Verse Twe (Score:5, Informative)
Re:The Book Of Internets, Chapter Three, Verse Twe (Score:4, Insightful)
Um... even if you run your own caching server, if your ISP runs a "transparent" web proxy it will do its own dns. You may in fact run DJB which is immune from this bug, but if your ISP runs an unpatched dns server you'll still be scrod despite running your own caching server.
Slick huh?
They need to take the dns lookup out of the web proxies.
Re:The Book Of Internets, Chapter Three, Verse Twe (Score:4, Insightful)
They need to take the dns lookup out of the web proxies.
The problem with doing that would be that it would then be impossible (at least using current DNS software, as far as I know) to allow clients on an internal network to have limited internet access without allowing them to perform DNS tunneling (and thereby upgrade their internet access to "full").
Once someone (anyone?) releases a DNS package that allows firewall-style rules (e.g. "client on this range of IPs may only resolve subdomains of the following domains...", "clients may only look up X distinct subdomains each of Y domains every Z hours" then the picture would probably change.
BIND 9 named views for access control (Score:4, Interesting)
Once someone (anyone?) releases a DNS package that allows firewall-style rules (e.g. "client on this range of IPs may only resolve subdomains of the following domains..."
I think you might be able to do that with the "views" feature of ISC BIND v9 named, although I've never tried. I know you can define ACLs for clients and control how they see the DNS using the ACL. You should be able to define forwarding zones for the domains you want to work, and blackhole everything else. I think.
http://www.isc.org/sw/bind/arm93/Bv9ARM.ch06.html#view_statement_grammar [isc.org]
Re: (Score:2)
"The problem with doing that would be that it would then be impossible (at least using current DNS software, as far as I know) to allow clients on an internal network to have limited internet access without allowing them to perform DNS tunneling "
You've lost me toally. I'm not talking about expolicit web proxies, but the "transparent" ones that ISPs use.
I can connect with ssh and ftp to free.tibet, but not via port 80 ("web") service. It's all in the wrist action of (the screw you I'm doing my own dns looku
Re:The Book Of Internets, Chapter Three, Verse Twe (Score:5, Informative)
unpatched websites
Have you been following this story. It's not sites that need the patch, it's DNS servers. Site owners are powerless if the ISPs fail to protect their domain name from the an entry leading to the spoof site's IP address.
Re: (Score:3, Insightful)
Yes, DJB "recognized" the problem by lobotomizing DNS, and he refuses to consider what will solve the problem once and for all, DNSSEC. Right...
Re: (Score:3, Interesting)
If you want to support verisign forever, go with dnssec.
Re: (Score:2)
It works tolerably well for X.509. What's your proposed alternative?
You're like those environmentalists who say "no" to nuclear, coal, wind (birds), dams (fish), solar (semiconductor manufacturing), and everything else, but who say "yes" to nothing.
DNS sploit result (Score:2, Funny)
%> /usr/bin/treaceroute fruity.stuff
traceroute to fruity.stuff (1.2.3.4), 30 hops max, 42 byte packets ...
evil bit detected. re-routing
I know (Score:4, Funny)
I exploited this and let a huge cache of people visit my site(127.0.0.1) in stead of the site they wanted to go. It was kickass.
Re: (Score:3, Funny)
HAHA, fool! now that I know your ip address, I shall soon hack you into oblivion!
Re:I know (Score:5, Funny)
Don't worry, I just disabled his intern
[CARRIER LOST]
DNS Glue poisoning was already known... (Score:2, Informative)
The interesting thing, DNS glue (additional) poisoning WAS known, just not widely. EG, the SECOND hit for "dns glue poison" in Google gets http://lists.oarci.net/pipermail/dns-operations/2006-May/000537.html [oarci.net].
Quoting Emin Gun Sirer:
Incidentally, the client should be wary of trusting glue records unconditionally, as they are non-authoritative. A well-known cache poisoning attack works by tricking clients to believe glue records for all time and for all queries. Glue should be trusted for only the lookup
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
No, but it's a "feature" that makes the attack possible. Turn it off, or make it stricter, and the attack falls apart.
Re: (Score:3, Informative)
Maybe it wasn't clear, but I was going to echo nweaver's reply:
djbdns's total lack of support for glue records (IIRC) is one of the reasons it's one of the few old dns software not vulnerable. And that's the point I was trying to drive: the glue records feature made the cache poisoning possible -- I just read the exploit code, and it uses Additional Section to inject the malicious entry. Without this feature, like in djbdns, the exploit wouldn't work.
Re:DNS Glue poisoning was already known... (Score:5, Insightful)
Congratulations, you confused the mods. Bailiwick checking was added to all DNS resolvers in response to glue poisoning and made cache poisoning through spoofed glue records very difficult. The current problem is that the typical filter rules are insufficient for stopping a glue poisoning attack which appears to come from the authoritative server: Kaminsky found a way around the glue poisoning countermeasure. This means that a very dangerous kind of attack which was thought to be defeated is now possible again.
Re: (Score:3, Insightful)
Read the quotation again...
Emin Gun Sirer: "Glue should be trusted for only the lookup in question[Emphasis added] for only the duration of that lookup.
This says "No Bailiwick checking at all": glue (additional) records should NEVER be cached. Period.
Re: (Score:2)
The problem is that glue records are often used to pass the addresses of nameservers required to resolve the domain in question. If that glue record can be passed back with a false address to the nameserver, the entire domain can now be controlled. If you can pull this off with a TLD, then the attack becomes much more serious. It appears at first glance that in addition to TTL restrictions (com has a TTL of two days), bailiwick limitations may limit these kinds of attacks (com, for example, is served off
Re:DNS Glue poisoning was already known... (Score:5, Informative)
It only works because the DNS server caches the result of the glue record, against the recommendation of the above writer.
The glue record is necessary if, say, you need to provide the address of a nameserver when you provide the name of the authoritative nameserver for a query. You should use that glue record for that query only.
What happens is that an attacker queries lbixds.google.com (or some other nonexistent domain) and then sends the server he issued that request to a response to that query that also has a glue record giving a false address for ns.google.com. If the DNS server only used that false address for resolving lbixds.google.com, cached lbixds.google.com, and left it at that, then lbixds.google.com would be the only entry the attacker could poison -- basically useless. However, the DNS server caches the glue record giving the address for ns.google.com, too.
Re: (Score:2)
... and then sends the server he issued that request to a response to that query that also has a glue record...
I don't understand what you mean there; I'm presuming you meant to say "...and the server issues a response to that query that also has a glue record..." In any case, I don't understand why a properly-designed resolver would pay any heed to such a reply. If it's asking the google.com authority to resolve "lbixds", and it receives an answer, why would it also expect (and cache) an unsolicited answer for the domain "ns" (in your example)?
-b
Re: (Score:3, Insightful)
Because that's how DNS generally treats requests that fall within the same domain (known as bailiwick protection). The question that you ask has been asked numerous times, and there's certainly good reason to review the logic behind Additional Resource Record handling, but tinkering with DNS is a very tricky thing. A proposed solution may fix the problem, but break other things on a much wider scale.
Re:DNS Glue poisoning was already known... (Score:5, Informative)
So, first part. An attacker is trying to poison a DNS cache. Generally, he'd be interested in poisoning a DNS server that's a caching server for a group of people, like one run by a regional ISP. An efficient way of getting a poisoned record into its cache is to issue a request to that server, and then immediately send a forged response to the server. So, for example, I issue my local nameserver a request for abcd.google.com. It doesn't have this cached (you don't say!), so it starts trying to resolve it. I quickly send it a forge response for abcd.google.com, and it believes me. Transaction IDs make this a slim chance that it'll believe me, but it's still a chance, and I can issue a ton of requests to different fake addresses.
The answer to the second part is tricky. Basically, say I want to resolve mail.google.com. I have nothing about google.com in my cache. So I contact the nameserver for .com. It isn't authoritative for the google.com domain, but it knows who is, and it tells me so. (Say that it's ns.google.com.) Knowing ns.google.com is the nameserver for that domain is useless without its IP address, so it tacks on a glue record that gives me the address of ns.google.com. Now I can contact ns.google.com to ask it the IP of mail.google.com.
Originally, these records were just accepted. This is a huge security hole: I could request bob.domainiown.com, send a legitimate response (I control domainiown.com), and tack on a record telling them where ns.google.com is, even though I'm not authoritative for that. Now, such a record can only be attached to a request that is in the same domain, so I need to ask for bob.google.com to attach an ns.google.com record, which requires me to forge a response.
There are a number of situations where these auxiliary records are necessary, so they can't just be ignored. However, they shouldn't be cached -- they should be used only for the one request that generates them.
Re: (Score:2)
Trojans to a glue factory..... .....are you playing practical jokes on your hooker?
BIND is not a demon (Score:3, Informative)
it's an acronym for "Berkeley Internet Name Daemon"
Actually, BIND stands for "Berkeley Internet Name Domain". Berkeley did the seminal work for the original DNS implementation, and that's what they called their idea. BIND is a suite which includes a stub resolver, some utilities, and named (name daemon). (Along with some other stuff, now.)
If you want to get fancy, "ISC BIND named" is the proper name of the software we're talking about. ISC is the company, BIND is the product, named is the program.
See: http://www.isc.org/sw/bind/index.php [isc.org]
See if you're vulnerable (Score:5, Informative)
There's a tool on the site below that apparently checks if the DNS you're currently using is vulnerable to such an attack. I checked my work DNS and my home DNS - both were fine. Apparently OpenDNS is secure as well, so there's probably nothing to worry about.
http://www.doxpara.com/ [doxpara.com]
Re:See if you're vulnerable (Score:5, Informative)
The DNS OARC (http://dns-oarc.net) has an improved version:
http://entropy.dns-oarc.net/test/ [dns-oarc.net]
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2)
Kinda sucks for those of us who have split-horizon DNS though.
Test your own server (Score:5, Informative)
A Google search revealed this way to test specific DNS servers from the command line (in case you're using a DNS server other than the one that's authoritative for the netblock you're in):
Good:
$ dig +short @208.67.222.222 porttest.dns-oarc.net txt
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"208.67.222.222 is GOOD: 26 queries in 0.1 seconds from 26 ports with std dev 17746.18
Poor:
$ dig +short @206.13.28.12 porttest.dns-oarc.net txt
z.y.x.w.v.u.t.s.r.q.p.o.n.m.l.k.j.i.h.g.f.e.d.c.b.a.pt.dns-oarc.net.
"206.13.28.13 is POOR: 26 queries in 0.2 seconds from 1 ports with std dev 0.00"
More discussion on this method here:
http://www.dslreports.com/forum/r20759262-CERT-VU800113-DNS-Cache-Poisoning-Issue~start=20 [dslreports.com]
Re: (Score:2, Informative)
Re: (Score:2)
Re:See if you're vulnerable (Score:4, Informative)
So.. What's their IP?
It looks like 66.240.226.139 to me...
Re: (Score:3, Insightful)
Doesn't OpenDNS fail to properly return NXDOMAIN results, or is that another service (I've not slept in >24 hours, so I could be mistaken.)
More edifying than TFA's script (Score:3, Informative)
Re: (Score:2, Funny)
This link is in French. I'd rather read scripts. At least they're in Geek.
Use djbdns! (Score:2, Interesting)
Even though it is not as popular as BIND but djbdns doesn't have this vulnerability. Remember Dan J Bernstein had the original idea in 2002 about this issue and Dan Kaminsky and Paul Vixie looked into this and found these vulnerabilities.
Re: (Score:2)
Re: (Score:3, Interesting)
6 root root 4096 2002-10-11 11:10 dnscache
That list my oldest still running djb dnscache install, yes the kernel and glibc have been upgraded around it. The mail server it's on has handled 750k messages per day. Does rdns lookup on smtp connections from servers, from our tests almost every valid smtp mail source has a reverse dns name of some sort. Spambots virus are the largest amount of mail from unnamed IPs.
This being said, if your running out of file descriptors you probably have one of the foll
Re: (Score:2)
Re: (Score:3, Insightful)
Cryptography is not magic.
While I don't expect the AC to read this, it lays out why we are not going to see DNSSEC for some time. http://www.internetnews.com/security/article.php/3758566/Is+DNSSEC+the+Answer+to+Internet+Security.htm [internetnews.com]
http://en.wikipedia.org/wiki/DNSSEC [wikipedia.org] is also suprisingly good with a lot of easy to read information, and includes why the current DNSSEC specs may open up more security risks.
example1 >Note that someone could deliberately or inadvertently cause a degradation of service by send
Help Please (Score:2)
Hey all, I see lots of comments re: OpenDNS as a good solution if your ISP sucks (as mine does) and has not patched.
But I can't trust my DNS to resolve correctly to OpenDNS.com or whatever.
Anyone got dotted quads for me?
Re: (Score:3, Funny)
Unfortunately it.slashdot.org has already been poisoned; you actually posted that request to an elaborate mock-up of the real slashdot, and the replies are coming from l33t hackers who are supplying you with false DNS servers which currently appear to work correctly.
You'd best disconnect from the internet and burn your computer. It's the only way to be sure.
Re: (Score:2)
208.67.222.222 208.67.220.220
Seconded, don't trust your ISP... for home use the 2 above work just fine. In addition, some of the adult-filtering for curious kids in the house is a WONDERFUL optional side benefit.
In Soviet Russia (Score:2)
DNS Cache poisons you.
Sorry, I had to.
Use OpenDNS if your ISP is vulnerable (Score:5, Informative)
I used one of the tests below and found that my ISP's DNS servers were vulnerable. Now I am using the OpenDNS [opendns.com] servers on all of my clients instead:
208.67.222.222
208.67.220.220
Their servers are not vulnerable, and you can create an account to enable things like antiphishing at the DNS level (much better idea then a browser plug-in).
If you find that your ISP's routers are vulnerable, your best bet is switch to OpenDNS...or just run your own caching server.
Microsoft's hamfisted "patch" (Score:5, Informative)
In case anyone is dumb enough to use a Microsoft DNS server as a authoritative internet DNS server -
MS has released two lovely patches -
KB951746 and KB951748
The problem with this fix is that it turns the DNS.EXE daemon into a UDP socket grubbing whore.
After the patch, the DNS.EXE daemon grabs no less than 2500 freaking UDP sockets.
This wreaks havoc on anything that - you know - needs UDP sockets on the same server.
So far Zonealarm, Blackberry BES and Sphericall VOIP software all break with this "patch"
Stay tuned for more fun to come ...
Re: (Score:2)
It sounds more like Zonealarm, BES and Sphericall are broken. Why would they try to listen on a UDP port that is use? There are only 65,000+ ports available, why are they running into conflicts when only 2500 are in use? If the port is not in use, why are they not validating the data they are receiving through UDP?
Not to mention that similar conflicts are starting to show up on patched BIND servers that are running other services which rely on UDP.
Re: (Score:3, Informative)
ZoneAlarm breaks in the sense that it thinks Microsoft's new DNS resolver is behaving like malware and should therefore not be trusted. ZoneAlarm has a ridiculous little slider with three security levels marked "High", "Medium" and "Low"; if you set it to "High" (as recommended), you can't resolve DNS.
ZoneAlarm has released a patch to work around the problem. You can set your security setting to "Medium" while you download the update.
I think this is exactly what is needed ... (Score:2)
Sorry, but I'm pretty certain that this is needed. It needs to use random UDP ports for each reply. If it's just 2500 ports, that's bad. It should use around 64K ports.
One chosen at random, for each reply it is sending.
Or is it something I do not understand in the problem you're describing? Or is it you to that do not understand the problem?
help all the SOHO router people (Score:3, Interesting)
Re: (Score:2)
From my understanding, if you are using a DNS proxy on your router (which most SOHO routers seem to do now), then you might be vulnerable. I checked my 2wire (which has no option to turn off DNS proxy for DHCP clients) and they have not updated the firmware in forever. :/
See my post below about switching to OpenDNS instead.
Re: (Score:3, Informative)
Generally the proxy on a SOHO router runs as a forward-only cache (or even just a simple proxy) to your ISP's DNS. As such it's really your ISP's DNS that is or isn't vulnerable, because you aren't ever going to see records from anyone else, nor will anyone else know you're asking for them.
The test listed above -- http://entropy.dns-oarc.net/test/ [dns-oarc.net] -- will let you know what the rest of the world sees as your DNS source address, and whether or not that source is sufficiently randomized.
Re: (Score:3, Informative)
Mod parent up! Home broadband/WiFi routers may well be vulnerable unless you've specifically checked.
Unless you've checked the internals of your home router and whether it's using the wrong sort of DNS proxy/cache, I recommend *everyone* with a home router switches their client computers to using OpenDNS, so it's Windows/Mac/Linux directly requesting DNS services from OpenDNS. (If you have DHCP for your clients at least you only need to change the router, but any laptops should also explicitly use OpenDNS
Re:help all the SOHO router people (Score:4, Informative)
Most of these routers don't run caching, recursive resolvers -- they just forward the request to your ISP's DNS server. As such, they are immune.
NAT routers (Score:4, Informative)
Simply patching your DNS server may not be enough.
Re:And the "fix" isn't (Score:4, Interesting)
The fix is DNSSEC.
Re: (Score:2)
Ever think that the government would let us have an unhackable Internet-used protocol for anything? If it was all secure, how'd the NSA get in?
Re: (Score:3, Funny)
Re:And the "fix" isn't (Score:5, Interesting)
DNSSEC is a steaming pile, though after thirteen years, many RFCs -- each of which read "This Time For Sure!" -- it may in fact be workable.
It is _a_ fix to this problem, but there are many simpler fixes that seemingly are being discarded for reasons I don't quite understand -- perhaps more full threat models are the target problem, but securing DNS doesn't make sense if we're then going to use HTTP to the addresses resolved! On the flip side, if we were using TLS everywhere, then dicking with DNS amounts to a DoS, which is much less powerful than the arbitrary redirection attacks we have now.
One such simpler fix is using EDNS0 to add a nonce RR (goes out in the Query, comes back in the Additional section). And while EDNS0 is subject to rollback attacks, DNSSEC depends on EDNS0. So that's not an excuse not to use it.
Re: (Score:3, Informative)
"DNSSEC is a steaming pile"...
Yes! Unfortunately this is completely and utterly true. Unlike many of the great crypto tools we have available to us (ssh, pgp, https), DNSSEC increases complexity by an order of magnitude.
Watch as you lose the ability to effectively block full zone transfers from your domain name since DNSSEC requires NSEC records, which are essentially a linked list of all your zone entries!
Be amazed when you find out that you need to run a cron job to sign all of your zone files every 15 da
DNSSEC today (Score:2)
The fix is DNSSEC.
DNSSEC won't solve the present problem. Almost nobody has deployed it. In particular, the root zone does not use it, and I haven't seen mention of any GTLD or ccTLD zone doing so, either. Certainly not the big three (.COM, .NET, .ORG).
I am not saying cryptographically securing DNS is not a good idea. It is, and indeed, is the only viable long-term fix. I'm just saying that DNSSEC is not magic dust.
Re: (Score:2)
Hey-oh! .ORG is switching to DNSSEC.
Also, several country level TLDs use it.
Re: (Score:2)
I don't believe the people saying DNSSEC is the answer are suggesting that if you deploy DNSSEC on your nameserver today you'll be safe. They're saying if everyone deploys DNSSEC on everybody's nameservers including the root zone, then we'll all be safe. DNSSEC is not a short-term solution, but if the spec is stable enough now and the various kinks have been worked out, then now is a good time to start testing it on root servers, gTLD servers, and ccTLD servers. Once that's done, then ISPs should start u
Re:I can't contact ftp.debian.org this last 2 days (Score:4, Informative)
try http://ftp.debian.org/ [debian.org]
for a bit more info:
http://wiki.debian.org/ftp.debian.org [debian.org]
Re: (Score:2)
Unclear on the concept (Score:3, Insightful)
Oh noes, the world is going to crash down around us! Just saying, why overreact?
A problem you ignore will have full impact. A problem you prepare for and take counter-measures against is prevented from having a serious impact. That's the whole point.
We spent great effort fixing Y2K bus, thus prevented the bugs from causing serious damage. Therefore, you conclude, we should not have fixed the Y2K bugs.
I guess, since seat belts have saved lives, we should not wear them.
Get it now? :-)
Re: (Score:2)
We spent great effort fixing Y2K bus, thus prevented the bugs from causing serious damage. Therefore, you conclude, we should not have fixed the Y2K bugs.
You misunderstand his logic. The logic was: we spent great effort fixing Y2K bugs, which would not have caused serious damage (even if we had not fixed them). Therefore, we should not have fixed the Y2K bugs.
I happen to agree with him, for the most part. Y2K, by the time it was all said and done, was a huge marketing scam. I mean, I even had a stereo system that said "Y2K compliant!" on the box. WTF? There may have been some legitimate concern at first, but it wasn't long before people blew the whole thing
Re: (Score:2)