[12584] in bugtraq
Re: BIND bugs of the month (spoofing secure Web sites?)
daemon@ATHENA.MIT.EDU (Peter W)
Sun Nov 14 17:25:07 1999
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.10.9911132116410.18106-100000@localhost>
Date: Sat, 13 Nov 1999 21:34:24 -0500
Reply-To: Peter W <peterw@USA.NET>
From: Peter W <peterw@USA.NET>
X-To: "D. J. Bernstein" <djb@CR.YP.TO>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <19991113011424.6999.qmail@cr.yp.to>
At 1:14am Nov 13, 1999, D. J. Bernstein wrote:
> A sniffing attacker can easily forge responses to your DNS requests. He
> can steal your outgoing mail, for example, and intercept your ``secure''
> web transactions. This is obviously a problem.
If by secure web transactions, you mean https, SSL-protected, then, no
they can't. SSL-enabled HTTP uses public keys on the server side to verify
server identity. These keys are typically signed by a Certificate
Authority (Verisign, Thawte, etc.) and clients will not trust server keys
unless they have a valid, non-expired certificate from a known, trusted
CA. Even if the attackers monitored all your network communications, they
still would not have your web server's private key and its passphrase.
While DNS spoofs may be practical, impersonating an SSL-enabled Web server
requires considerably more than lying about IP addresses.
-Peter
> We know how to solve this problem with cryptographic techniques. DNSSEC
> has InterNIC digitally sign all DNS records, usually through a chain of
> intermediate authorities. Attackers can't forge the signatures.
> Of course, this system still allows InterNIC to steal your outgoing
> mail, and intercept your ``secure'' web transactions. We know how to
> solve this problem too. The solution is simpler and faster than DNSSEC,
> though it only works for long domain names: use cryptographic signature
> key hashes as domain names.
