[11437] in North American Network Operators' Group
Re: how to protect name servers against cache corruption
daemon@ATHENA.MIT.EDU (Christopher Masto)
Wed Jul 30 00:20:20 1997
Date: Wed, 30 Jul 1997 00:12:46 -0400
From: Christopher Masto <chris@netmonger.net>
To: nanog@merit.edu
In-Reply-To: <199707300255.VAA07213@enteract.com>; from Thomas H. Ptacek on Tue, Jul 29, 1997 at 09:55:48PM -0500
On Tue, Jul 29, 1997 at 09:55:48PM -0500, Thomas H. Ptacek wrote:
> What I am asserting to you is that there are variants on this attack which
> are not currently fixed by BIND 8.1.1. On a related note, there are things
> that can be done to strengthen DNS implementations (such as BIND) against
> these attacks that do not involve DNSSEC.
(This being still basically on-topic as it relates to the security of
a critical component..)
Would either you or Ben Black please give an example of a change that
fits the characteristics you have described? I see a lot of "Yes it
can. No it can't. Yes it can." but nobody has actually supplied any
_details_. Paul has written papers on DNS security, along with BIND
itself, and I'm inclined to believe him when he says there are no more
trivial fixes. If you know of one, why don't you share it? I'm not
asking for code, just a description of what you want changed. Then
someone will either implement it or find that it is flawed.
--
= Christopher Masto = chris@netmonger.net = http://www.netmonger.net/ =
= NetMonger Communications = finger for PGP key = $19.95/mo unlimited access =
= Director of Operations = (516) 221-6664 = mailto:info@netmonger.net =
v---(cut here)---v
--
yourname@some.dumb.host.com
"Keep in mind that anything Kibo says makes a great sig." -- Kibo
^---(cut here)---^
