Bugtraq mailing list archives
Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)
From: "Amit Klein" <aksecurity () gmail com>
Date: Tue, 24 Jul 2007 23:07:59 +0300
1. The URL you provided doesn't mention any analysis of BIND. 2. You probably refer to a different, later article titled "DNS Cache Poisoning - The Next Generation", by LURHQ Threat Intelligence Group (http://www.lurhq.com/cachepoisoning.html). 3. You may have noticed that both papers are in fact referenced in my paper, as [8] and [9], respectively. 4. Also, the paper clearly outlines the novelty in the introduction section. The attractors method, as described in LURHQ's paper, requires sending 5000 forged responses, and is guaranteed to succeed only 20% of the time. In the new paper, a method is described in which by sending 1-10 responses, the attack is guaranteed to succeed (100%). All this of course given standard conditions. The paper also details why sending 5000 responses is way less feasible than sending 10 (ini terms of likelihood to get to the target server before the gebuine response does). -Amit On 24 Jul 2007 17:40:35 -0000, securityfocus () networkontap com <securityfocus () networkontap com> wrote:
I don't exactly see how this is new "News" since Zalewski's paper on TCP sequence number analysis (which included analysis of versions of BIND): http://lcamtuf.coredump.cx/newtcp/ -ntn
Current thread:
- "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Amit Klein (Jul 24)
- <Possible follow-ups>
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) securityfocus (Jul 24)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Amit Klein (Jul 24)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Jamie Riden (Jul 26)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Theo de Raadt (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Gadi Evron (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Tim (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Amit Klein (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Tim Newsham (Jul 27)
- Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer) Amit Klein (Jul 27)