DNS Flaw Not Resolved?

Seems the recent DNS patches are not a magic bullet:

Quote:

---

The Internet remains vulnerable to exploits of a critical security flaw in the Domain Name System, a Russian programmer demonstrated last week. Writing on his blog on Friday, Evgeniy Polyakov posted that he had succeeded in getting patched DNS software to return an incorrect location in less than 10 hours.

---

That doesn't mean that the patches are valueless, but that more work is required on a solution.

OK, I don't think that we need worry about script kiddies and part time criminals here, as the resources required are probably well beyond their means. Unfortunately malicious activity on the internet has taken an increasingly professional criminal turn of late, and the pros certainly can afford it if the rewards are there for the taking.

Full article here:

http://www.crm-daily.com/story.xhtml...d=0300032O5BDC

The patch was never intended to fix these issue just make it a lot more time consuming to pull off. What this article fails to mention is that this was done over a Gigabit Ethernet connection. So you need a very fast link to the DNS server and for no one to notice that you flooded it. DNS is still a broken system security wise but what else is new. Doxpara has some great stuff on this whole mess minus the BS fear mongering. http://www.doxpara.com/?p=1215

Quote:

---

What this article fails to mention is that this was done over a Gigabit Ethernet connection. So you need a very fast link to the DNS server

---

Quote:

---

"So far, what Polyakov has managed to prove is that in a controlled test with highly powerful systems on a fast network, Dan Kaminsky's attack-vector window still exists and is about 10 hours in length,"

---

seems you missed that bit?

Quote:

---

minus the BS fear mongering.

---

Quote:

---

OK, I don't think that we need worry about script kiddies and part time criminals here, as the resources required are probably well beyond their means.

---

Why are people surprised when patches don't fix things that were never engineered for their current use? DNS is another Internet service that was never meant to be used in the capacity it currently serves. Until we stop bolting wings on to VW bugs and truly engineer purpose built services, this stuff will never end.

There is your public service announcement for the day.
;)

--Th13