Subject: [dnsop] Re: I-D ACTION:draft-ietf-dnsop-reflectors-are-evil-01.txt

From: Pekka Savola <[email-masked]>
Date: Sun, 9 Jul 2006 13:24:17 +0300 (EEST)

Hi,

In general, this was a good document.  A couple of comments:

    1.  The attacker starts by configuring a record (LRECORD) on any zone
        he has access to (AZONE), normally with large RDATA and TTL.

==> AFAICS, this step is not necessary.  The attacker could just use 
whatever 3rd party DNS records that already exist, right?  (Though to 
get better effect, it should have large RDATA and TTL)

    2.  Taking advantage of clients (ZCLIENTS) on non-BCP38 networks, the
        attacker then crafts a query using the source address of their
        target victim and sends it to a public recursive nameserver
        (PRNS).

==> s/a query/a query for LRECORD/ just to be clear

    3.  Each PRNS proceeds with the resolution, caches the LRECORD and
        finally sends it to the target.  After this first lookup, access
        to the authoritative nameservers for AZONE is normally no longer
        necessary.  The LRECORD will remain cached for the duration of
        ...

==> If the attacker always used its own LRECORDs, the attack would be 
traceable just by looking at who owns the zone, right?  But as the 
attacker may also use 2rd party LRECORDs, the owner of LRECORD doesn't 
help in figuring out who was responsible for the attack.

    From the description of the problem in the previous section it
    follows that the solution to this sort of attacks is the wide
    deployment of ingress filtering [BCP38] in routers to prevent use of
    address spoofing as a viable course of action to elicit the 
attacks.

==> I'd also add reference to BCP84, because I think it's a much more 
useful reference but I may be biased as I'm an author.. :-)

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
.
dnsop resources:_____________________________________________________
web user interface: http://darkwing.uoregon.edu/~llynch/dnsop.html
mhonarc archive: http://darkwing.uoregon.edu/~llynch/dnsop/index.html

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Mon, 10 Jul 2006 09:51:39 +0200

On Sun, Jul 09, 2006 at 01:24:17PM +0300,
 Pekka Savola <[email-masked]> wrote 
 a message of 46 lines which said:

> The attacker could just use whatever 3rd party DNS records that
> already exist, right?

Existing actual records do not typically provide a good amplification,
they are often too small. So, you are right, this step is no
*necessary* but in practice is very common.

.