Here is more evidence:
http://www.doxpara.com/
and from the final paragraphs or perhaps you guys just don't trust
researchers or want to be in denial about everything and see the 'Net as oh
so secure and safe
So, does that mean its always better to attack DNS than BGP? Oh, you
competitive people would like things to be so simple, wouldn’t you Pilosov
and I talked for about a half hour at Defcon, and I’ve got nothing but
respect for his work. Lets look at the other side of things for a moment.
First, BGP controls how you route to your name server — if not your recursive
server, which may be inside your organization and thus immune to exterior
routing protocol attack, then the authoritative servers your recursive
servers depend on. Something like this actually happened recently — witness
the curious case of the Unauthorized L Roots, and note the astonishingly
familiar potential attacks being described. Yes, that’s precisely the
scenario of BGP used to hijack root DNS servers — with such hijacking
actually being noticed.
More importantly, much of my talk, in which I discuss the impacts of MITM
attacks, applies to Kapela and Pilosov’s work as well. It’s 2008, we still
don’t have secure email, and that’s just as much of a problem in the face of
BGP attacks as it is in the face of DNS attacks.
So, in summary, it’s an interesting side discussion regarding the
similarities, differences, and overlaps between DNS and BGP attacks. BGP
has far fewer potential attackers, fewer necessary defenders, is a much less
agile attack, and is way easier to monitor forensically (and indeed, with
companies like Renesys, is being monitored forensically). But so what? It
can work, and when it does, it can do much of the same damage we were afraid
of via DNS.
We have now had three attacks, in one year, that underscore the
fundamentally untrustworthy nature of routing. DNS, BGP, and SNMPv3 all
underscore the fact that the network should only be trusted as a best-effort
data transmission system — that if you want to make sure everything’s OK, you
can’t just assume — you need to cryptographically authenticate, you need to
cryptographically encrypt, and you need to do these things to a level of
security beyond “secure unless there’s an attacker.â€
A lot of us — myself included, when I first started really looking at SSL —
thought we were already distrusting the network. We weren’t. That’s what
Mike Perry’s telling us, that’s what Mike Zusman’s telling us, and that’s
what I’m telling you.
There are some real discussions to be had. It’s 2008. Where’s secure
email? Why is almost every autoupdater not from Microsoft thoroughly broken?
What is going on with non-browser network clients that can’t handle traffic
from an untrusted server? How are we going to migrate the web, and indeed
all commercial network activity, to authenticated and encrypted protocols
that respect the fundamentally untrustworthy nature of the network?
DNS vs. BGP vs. SNMPv3 is inside baseball. The reality is as follows:
Weaknesses in authentication and encryption, some which have been known to
at least some degree for quite some time and many of which are sourced in the
core design of the system, continue to pose a threat to the Internet
infrastructure at large, both by corrupting routing, and making those
corrupted routes problematic.
The question is what to do about it.
(That all being said, I’ll be writing shortly with an update on defenses
against DNS. There be news.)
Share and Enjoy: These icons link to social bookmarking sites where readers
can share and discover new web pages.
August 27, 2008 | Filed Under Uncategorized
"Root Kit" wrote:
> On Thu, 28 Aug 2008 22:29:00 -0700, Dan
> <Dan@discussions.microsoft.com> wrote:
>
> >The technology industry is mainly in denial about Chris Cquirke,
> >mvp's research and now Dan K's research with DNS
> >Pollution and the biggest reason this is such a big problem is the NT source
> >code that has been leaked out over the Internet in the past and is solid
> >external defense but has no true internal safety like DOS (Disk Operating
> >System).
>
> I don't know what it is you're smoking, but it certainly doesn't seem
> healthy for you.
>