[119233] in North American Network Operators' Group
Re: What DNS Is Not
daemon@ATHENA.MIT.EDU (David Ulevitch)
Tue Nov 10 10:18:05 2009
Date: Tue, 10 Nov 2009 10:17:15 -0500
From: David Ulevitch <davidu@everydns.net>
To: sthaug@nethelp.no
In-Reply-To: <20091110.150428.41705067.sthaug@nethelp.no>
Cc: nanog@merit.edu
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On 11/10/09 9:04 AM, sthaug@nethelp.no wrote:
>>> When the conficker worms phones home to one of the 50,000 potential
>>> domains names it computes each day, there are a lot of IT folks out
>>> there that wish their local resolver would simply reject those DNS
>>> requests so that infected machines in their network fail to phone
>>> home.
>>
>> That's an extremely bad idea: many of the domains generated by the
>> Conficker algorithm are already registered by a legitimate registrant
>> (in .FR: the national railways, a national TV, etc).
>
> It's an idea that needs to be used *with caution*. We did something
> similar as part of testing a new DNS product, and found that any such
> list of domain names needed to be *manually* vetted before being used
> as input to a DNS-based blackhole system. We also found that we had
> to explicitly whitelist a number of domains (generated by Conficker
> but registered many years ago and pretty clearly legit).
This is correct. And we take this into consideration in determining
what to block using our existing datasets, which are sufficient
considering the volume of DNS traffic that crosses our network.
-David
