[106155] in North American Network Operators' Group
Re: Exploit for DNS Cache Poisoning - RELEASED
daemon@ATHENA.MIT.EDU (Jasper Bryant-Greene)
Wed Jul 23 21:28:27 2008
From: Jasper Bryant-Greene <jasper@unleash.co.nz>
To: Joe Abley <jabley@ca.afilias.info>
In-Reply-To: <C2FDB4A7-AFF6-401E-BC51-EA168239312A@ca.afilias.info>
Date: Thu, 24 Jul 2008 13:27:00 +1200
Cc: nanog@merit.edu, Joe Greco <jgreco@ns.sol.net>
Errors-To: nanog-bounces@nanog.org
On Wed, 2008-07-23 at 21:17 -0400, Joe Abley wrote:
> Luckily we have the SSL/CA architecture in place to protect any web
> page served over SSL. It's a good job users are not conditioned to
> click "OK" when told "the certificate for this site is invalid".
'course, as well as relying on users not ignoring certificate warnings,
SSL as protection against this attack relies on the user explicitly
choosing SSL (by manually prefixing the URL with https://), or noticing
that the site didn't redirect to SSL.
Your average Joe who types www.paypal.com into their browser may very
well not notice that they didn't get redirected to
https://www.paypal.com/
-Jasper
