Subject: RE: DNS Blackhole attack

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sun, 6 Mar 2005 07:49:50 -0800

[ Moderators note: Post was moderated, either because it was posted by 
   a non-subscriber, or because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore 
   delete relevant posts by non-subscribers. Please fix your 
   subscription addresses. ]

First we have to understand that we are dealling with a very different
security problem to the one that was considered when DNSSEC was first
proposed. At that time the governing paradigm was 'security perfectionism'.
We are facing a rather different problem, criminal gangs with significant
but finite resources.

We do not need to preclude an attack absolutely, but we do need to reduce
the incentive to try. In particular we want to make it such that an attacker
is unlikely to believe that they will be able to recover the cost of
developing an attack before it is closed.

DNSSEC might be overdesigned for the current set of attacks but as a
pragmatic matter it is very unlikely that it would be possible to get
agreement on a simpler scheme in less time than it would take to deploy the
current DNSSEC. Also the combination of four years further action of Moore's
law, the use of DNS to distribute security policy information and an
imminent pain point mean that deployment possibilities are now open that did
not exist in 2000.

To answer Florian's point, yes it looks like this particular attack is a bug
exploit, not a protocol exploit, but the attack is illustrative of the type
of measure being used to perform phishing type attacks. It takes us much
longer to respond than it takes the attacker to switch tactics. 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>