Subject: [dnsext] New defence to Kaminsky attack

From: "George Barwood" <[email-masked]>
Date: Tue, 16 Mar 2010 15:14:50 -0000

I think I have discovered a new defence to the Kaminsky attack that avoids any extra queries in normal operation.

A typical Kaminsky attack is to attack a domain, say

www.example.com

by asking a series of questions

<random>.www.example.com

and sending spoof referral responses ( "Phantom Referrals" ) with a delegation to a machine controlled by the attacker, e.g.

www.example.com NS ns1.bad.net

The true response will be NxDomain, normally with a SOA record

example.com SOA ......

To defend, when we get a NxDomain response, we mark the domains below the zone with a NZ flag ( "Not a Zone" ). 
If there is no SOA record ( should be unusual ), we assume the zone is the Bailiwick ( the Owner of the NS record
that was used to select the name server for the query ).

If unexpectedly we later get a NS record for a NZ domain, we reject NS the record, clear the NZ flag, and retry ( if necessary ).

Complete Acceptance rules
====================
When reading a response, only the following records are accepted

(1) Records in the Answer section of an Authoritative response (AA=1) that have
Owner = QNAME ( the domain of the Question ).

(2) NS records in the Authority section that have Owner strictly below the Bailiwick, 
and with the Owner NZ flag clear.

(3) A / AAAA records in the Additional section that resolve an accepted NS record.

HTH,
-- George