Whitepaper: DNS zone redelegation

From: Bernhard Mueller <research@sec-consult.com>
To: Full Disclosure <full-disclosure@lists.grok.org.uk>,Bugtraq <bugtraq@securityfocus.com>
Subject: Whitepaper: DNS zone redelegation

Newly emerging techniques of DNS cache poisoning have caused quite a
stir recently, prompting security researchers to speculate on the nature
of the issue, and naturally inducing press stunts by some individuals,
including "accidential" information leaks and hasty exploit releases.
Many other, more relaxed researchers, who had figured out the attack and
had coded working exploits within a few hours (which, by the way, was
incredibly easy to do, knowing that an undocumented attack actually
existed), decided to coordinate with Dan Kaminsky, who had organized a
huge multi-vendor security patch, and withhold information for the
proposed 30 days.

SEC Consult's researchers were among the first to write a working "fast
cache poisoning" exploit, details of which will now be published in a
whitepaper, which also includes some calculations on the reliability of
the attack.

The paper details a way of making DNS cache poisoning / response
spoofing attacks more reliable. A caching server will store any NS
delegation RRs if it receives a delegation which is "closer" to the
answer than the nameservers it already knows. By spoofing replies that
contain a delegation for a single node, the nameserver will eventually
cache the delegation when we hit the right transfer id.





Bernhard Mueller
Security Consultant

SEC Consult Unternehmensberatung GmbH

A-1190 Vienna, Mooslackengasse 17
phone     +43 1 8903043 34
fax       +43 1 8903043 15
mobile    +43 676 840301 718
email     b.mueller@sec-consult.com

Firmenbuch Wiener Neustadt: 227896t, UID: ATU56165223
Firmensitz: Prof. Dr. Stephan Korenstra\u0178e 10, A-2700 Wiener Neustadt

Advisor for your information security.

Copyright © 1995-2021 LinuxRocket.net. All rights reserved.