Subject: Re: dictionary attack on nameservers

From: Jay Daley <[email-masked]>
Date: Thu, 29 Jul 2004 09:44:52 +0100

Folks

Ted wrote on 29/07/2004 09:06:24:

> ad 1. It has being shown (several times) that (90-99%) zone
>       enumeration without AXFR is simple and dirt cheap.

I'm sorry to be picky but I don't think the above is true. 

When people register a name they use a name from a pool of possible names. 
 As a zone grows in size people begin to exhaust the easy pools and so 
need to invent new pools.  So the initial pools are often

        very short names (2, 3, 4 characters)
        generic words (eg music, buses, teeth)
        organisation/personal names
 
but as these grow people start to invent new ones

        generic hyphen generic
        generic plus number

and so on.

So the smaller a zone is, the easier it is to enumerate.  For small zones 
I can well believe a high percentage is possible.  However as zones grow 
the problem can get significantly harder.

If someone really has done this against a large zone then please let us 
know.  If you want to test it against ours then please let me know so that 
we can prepare for it.

Jay

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Roy Arends <[email-masked]>
Date: Thu, 29 Jul 2004 11:26:28 +0200 (CEST)

On Thu, 29 Jul 2004, Ted Lindgreen wrote:

> [Quoting Roy Arends, on Jul 29,  9:10, in "Re: dictionary attac ..."]
>
> > I have seen no claims that NSEC2/3/X can prevent zone walking or
> > enumeration. The goal is to make zone walking more expensive.
> >
> > The lock on my front door does not prevent break-ins. Its goal is to make
> > break-ins more expensive.
>
> When talking "more expensive", it is relevant to weight:

I did not say that the goals justify the means, nolo contendere on the
validity of the details you have provided.

Roy

---

From: [email-masked] (Geoffrey Sisson)
Date: Thu, 29 Jul 2004 10:34:21 +0100 (BST)

[email-masked] (Ted Lindgreen) writes:

> 1. how much more expensive
> 2. the cost of the lock
> 3. the value of what is being protected
> 
>       Most of us know that both spammers and domainname-traders
>       are doing this already for years on a daily basis with
>       all TLDs that have blocked AXFR.
> 
> ad 2. The cost of the proposed lock (NSEC2/3/X) means a new
>       protocol change, which is rather expensive.
> 
> ad 3. We are talking about the protection of one little aspect
>       (100 against 99% enumeration) of otherwise public
>       information. It has also been argued ((several times) that
>       for most, if not all, evil usage of zone-enumeration 90+ %
>       enumeration suffices.
> 
> To me it seems that in this case the weighting is completely out
> of balance.

There's a time consideration which this analysis doesn't take into
account: If `perfect' snapshots (less negligible effects due to routine
IXFRs) of the owner names in zones can be obtained frequently and with
low latency, then new possibilites become available.

It's one thing to have a photo; another to have a film.

Regards

Geoff