Subject: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt

From: [email-masked]
Date: Mon, 1 Sep 2008 10:45:02 -0700 (PDT)

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Domain Name System Operations Working Group of the IETF.

	Title           : Preventing Use of Recursive Nameservers in Reflector Attacks
	Author(s)       : J. Damas, F. Neves
	Filename        : draft-ietf-dnsop-reflectors-are-evil-06.txt
	Pages           : 8
	Date            : 2008-09-01

This document describes ways to prevent the use of default configured
recursive nameservers as reflectors in Denial of Service (DoS)
attacks.  Recommended configuration as measures to mitigate the
attack are given.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-dnsop-reflectors-are-evil-06.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Dean Anderson <[email-masked]>
Date: Mon, 1 Sep 2008 21:35:45 -0400 (EDT)

Has there been any subsequent attacks since the motivating attack was 
reported?  

Given that we now have some high-profile DNSSEC test zones (thanks to
David Conrad), there is now no reason at all to use a recursor in a DDOS
attack. One would merely make DNSSEC queries against a high-profile
authority server.

One can conduct attacks on well-known high-profile authority servers
without the risk of exposure inherent in searching out reflectors.

And I note that Paul Wouters previously asserted that 100:1
amplification is a non-issue. If so, then certainly reflector attacks
are also a non-issue for the same reason.

So, this draft is in search of a problem to solve. However, closing open
recursors may promote the sales of DNS servers to people who didn't need
them before, so I wonder about that.  And can we expect to see people
selling 'reflector blacklist' products to ISPs to block DNS to open
recursors, merely because the recursors are open?  Will we see
'reflector blacklist' people scanning for open recursors?

This draft reminds me of the claims that open relays somehow promoted
spam. In that case, claims persisted even though misconceptions about
anonymity or other benefits for spammers were dispatched years ago, even
though no genuine commercial bulk emailers used open relays after
Sanford Wallace's failed attempt in 1997. Indeed, Wallace's abuse failed
precisely because there was no anonymity offered. That incident
demonstrated that there were no benefits in abusing open relays.  But
despite all these contrary facts, persons selling anti-spam software
continued to assert that open relays somehow promoted spam. But their
claiFrom [email-masked]  Mon Sep  1 18:35:46 2008
Date: Mon, 1 Sep 2008 21:35:45 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: [email-masked]
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

Has there been any subsequent attacks since the motivating attack was 
reported?  

Given that we now have some high-profile DNSSEC test zones (thanks to
David Conrad), there is now no reason at all to use a recursor in a DDOS
attack. One would merely make DNSSEC queries against a high-profile
authority server.

One can conduct attacks on well-known high-profile authority servers
without the risk of exposure inherent in searching out reflectors.

And I note that Paul Wouters previously asserted that 100:1
amplification is a non-issue. If so, then certainly reflector attacks
are also a non-issue for the same reason.

So, this draft is in search of a problem to solve. However, closing open
recursors may promote the sales of DNS servers to people who didn't need
them before, so I wonder about that.  And can we expect to see people
selling 'reflector blacklist' products to ISPs to block DNS to open
recursors, merely because the recursors are open?  Will we see
'reflector blacklist' people scanning for open recursors?

This draft reminds me of the claims that open relays somehow promoted
spam. In that case, claims persisted even though misconceptions about
anonymity or other benefits for spammers were dispatched years ago, even
though no genuine commercial bulk emailers used open relays after
Sanford Wallace's failed attempt in 1997. Indeed, Wallace's abuse failed
precisely because there was no anonymity offered. That incident
demonstrated that there were no benefits in abusing open relays.  But
despite all these contrary facts, persons selling anti-spam software
continued to assert that open relays somehow promoted spam. But their
claimsms only promoted their own business---ORBS and Osirusoft were found
to be abusing open relays, and then selling blocking services. ORBS was
found in court (3 cases) to be using false statements about open relays
for its financial benefit. For another example closer to the authors of
the 'refectors-are-evil' document:  it was also discovered that ISC and
MAPS blacklist founder Paul Vixie was a director/owner of a Commercial
Bulk Mail company called Whitehat, along with Rodney Joffe. Joffe was
the founder of UltraDNS and Centergate Research, where Bill Manning
is/was chief scientist. Vixie is/was a board member of Nominum while
David Conrad was President of Nominum.  Much of this and more is written
up at http://www.iadl.org

I don't think we should buy ISC's line about 'reflector attacks' either.  
The reported attacks seem to me to be artificially contrived. The
justification for this document just doesn't hold water because anyone
wanting to use DNS to conduct attacks would make use of other more
damaging, more difficult to mitigate attacks that don't expose the
attacker to possible discovery.

The fundamental assertion underlying this document is that technology is
somehow inherently evil.  Technology is never evil. People might be
evil.  There are legitimate uses for open recursors, and that should 
continue to be recognized.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000   

 only promoted their own business---ORBS and Osirusoft were found
to be abusing open relays, and then selling blocking services. ORBS was
found in court (3 cases) to be using false statements about open relays
for its financial benefit. For another example closer to the authors of
the 'refectors-are-evil' document:  it was also discovered that ISC and
MAPS blacklist founder Paul Vixie was a director/owner of a Commercial
Bulk Mail company called Whitehat, along with Rodney Joffe. Joffe was
the founder of UltraDNS and Centergate Research, where Bill Manning
is/was chief scientist. Vixie is/was a board member of Nominum while
David Conrad was President of Nominum.  Much of this and more is written
up at http://www.iadl.org

I don't think we should buy ISC's line about 'reflector attacks' either.  
The reported attacks seem to me to be artificially contrived. The
justification for this document just doesn't hold water because anyone
wanting to use DNS to conduct attacks would make use of other more
damaging, more difficult to mitigate attacks that don't expose the
attacker to possible discovery.

The fundamental assertion underlying this document is that technology is
somehow inherently evil.  Technology is never evil. People might be
evil.  There are legitimate uses for open recursors, and that should 
continue to be recognized.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: David Conrad <[email-masked]>
Date: Mon, 1 Sep 2008 19:25:59 -0700

Dean,

On Sep 1, 2008, at 6:35 PM, Dean Anderson wrote:
> David Conrad), ...

You're quite welcome, but I really can't take the credit -- the IAB  
really was the instigator of the ns.iana.org service (assuming that's  
what you're talking about).  You might also want to thank the zone  
administrators of SE, BR, PR, BG, the RIPE in-addr.arpa zones, and the  
1500 or so other "production DNSSEC-enabled zones" (according to http://secspider.cs.ucla.edu/ 
, 11273 zones if you count "non-production" ones).

> This draft reminds me of the claims that open relays somehow  
> promoted spam.
[Trademark Dean Anderson paranoiac drivel deleted]
> David Conrad was President of Nominum.

I was never president of Nominum.  If you're going to take your  
tinfoil hat off and rant like someone off their meds, at least try to  
do a minimum of fact checking.  It makes your amusing conspiracy  
theories so much more interesting.

Regards,
-drc

---

From: David Conrad <[email-masked]>
Date: Mon, 1 Sep 2008 19:25:59 -0700

Dean,

Regards,
-drc

---

From: Dean Anderson <[email-masked]>
Date: Tue, 2 Sep 2008 00:34:12 -0400 (EDT)

> [Trademark Dean Anderson paranoiac drivel deleted]

You misuse the word paranoid.  The word 'paranoid', means one has an
unjustified fear. I have no 'unjustified fear', nor have I even
expressed fear. I've cited facts.  Rather than trying to dispute the
facts, you are just attacking me personally.

> theories so much more interesting.

I'm very sorry to get that wrong. Checking, I see you were only the CTO
and a founder of Nomimum, according to you ICANN bio. But my incorrectly
citing your position as being President vs being CTO and founder isn't a
very significant mistake when asserting your conflict of interest. My
trivial mistake doesn't seem to qualify as being 'rant like someone off
their meds'---You seem to exaggerate quite a bit. Struck a nerve, did I?

But indeed, things are worse than I said. Having now checked the facts,
I see now you were an Executive Director of the Internet Software
Consortium (ISC) from 1998 - 2001, just the period where many of these
things were going on.  Your conflict of interest in these matters is
pretty well established.

		--Dean

_________________From [email-masked]  Mon Sep  1 21:34:09 2008
Date: Tue, 2 Sep 2008 00:34:12 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: David Conrad <[email-masked]>
Cc: [email-masked]
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

> [Trademark Dean Anderson paranoiac drivel deleted]

You misuse the word paranoid.  The word 'paranoid', means one has an
unjustified fear. I have no 'unjustified fear', nor have I even
expressed fear. I've cited facts.  Rather than trying to dispute the
facts, you are just attacking me personally.

> theories so much more interesting.

I'm very sorry to get that wrong. Checking, I see you were only the CTO
and a founder of Nomimum, according to you ICANN bio. But my incorrectly
citing your position as being President vs being CTO and founder isn't a
very significant mistake when asserting your conflict of interest. My
trivial mistake doesn't seem to qualify as being 'rant like someone off
their meds'---You seem to exaggerate quite a bit. Struck a nerve, did I?

But indeed, things are worse than I said. Having now checked the facts,
I see now you were an Executive Director of the Internet Software
Consortium (ISC) from 1998 - 2001, just the period where many of these
things were going on.  Your conflict of interest in these matters is
pretty well established.

		--Dean

_________________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

____________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Peter Koch <[email-masked]>
Date: Sat, 6 Sep 2008 23:50:10 +0200

> 	Filename        : draft-ietf-dnsop-reflectors-are-evil-06.txt

this draft is in the "IESG Evaluation" state.
The purpose of this update was to address the issues raised in the last remaining
DISCUSS during IESG review (as mentioned during the DNSOP session in Dublin).
You can visit the changes (non-editorial only affecting the security
considerations section) through the tools site:
  <http://tools.ietf.org/wg/dnsop/draft-ietf-dnsop-reflectors-are-evil/>
Editors, AD and shepherd (me) judged these changes to be minor enough and
non controversial not to require another WG round.
The draft will be approved as soon as the DISCUSS will have been released.

To clarify, there's nothing that would suggest against the chairs' judgement
of WG consensus being maintained.  That said, any further discussion of
whether or not the draft should have been worked on is probably counterproductive
and consuming energy better spent on other current topics.
As any document, this document can be revisited at a later stage with time
passed and new facts on the table.
I'd not consider the perceived absence of facts establishing a "new fact".

-Peter [wearing a chair's hat]
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Peter Koch <[email-masked]>
Date: Sat, 6 Sep 2008 23:50:10 +0200

---

From: Dean Anderson <[email-masked]>
Date: Mon, 8 Sep 2008 10:37:04 -0400 (EDT)

Anytime you discover that the facts asserted and relied on for a
document are false, or the sources of those facts and assurances
discredited, that's a "new" fact. A good example was the discovery in
TLS-AUTHZ that the assurances made by the document authors that patents
were disclosed according to RFC3979 was false.  In the TLS-AUTHZ case,
the discovery of false facts justified the removal of IESG approval.

In this case, it was asserted that there was a serious problem with open
recursors being used in attacks. That asserted fact was the motivation
for this document.  However, in the time since the first two attacks, we
have seen no evidence of any further attacks, and the two small
motivating attacks now seem in retrospect to be contrived for this
document.  The motivating attacks were first reported on NANOG, which
has previously made false statements deceiving the public and network
operators, and is therefore not a reliable source. See
http://www.iadl.org/nanog/nanog-story.html Requests for substantiation
and evidence of the claims of serious attacks have not been
affirmatively answered in two years. No direct or indirect evidence for
further, serious attacks has been produced at all.

Analysis also shows an alternative DNS attack that requires less effort
from the attacker, does not expose the attacker to discovery, and is
much harder to mitigate and more damaging.  There is no reason anyone
considering using DNS as an attack vector would use open recursors.  
Analysis also shows that an attack using open recurors is easy to
mitigate.

The above are significant contrary facts that undermine the original
consensus (if there even was one, next)

On the point of consensus, I do not see that a WGLC succeeded for this
document.  A last call held in November 2006 resulted in most people
being against this document. The last message with "WGLC" and "evil" in
the subject line was on November 21, 2006, extending date of the WGLC.  
After the extension, there are several new versions, but no WG last
call.  I'm not entirely sure why this document is in the state 'IESG
Evaluation' or how it got to state "Publication Requested" by Ron Bonica
given the Working Group record and the objections raised.  According to
Section 7.5 of RFC2418, a rough consensus must exist before such a
request for publication is made by the WG chair(s)  to the Area
director.  It should also be noted that strong disapproval was voice in
the 2006 WGLC. The strong disapproval was based, in part, on the lack of
credible evidence supporting the need for this document. Two years
later, lack of evidence of real attacks is still a problem.  There is no
widespread ISP support for, or call for, this document.

I strongly disapprove this document, object to the submarined approval
process, and will appeal this document to the limit of the appeals 
process.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Mon, 8 Sep 2008 10:37:04 -0400 (EDT)

--Dean

---

From: Ron Bonica <[email-masked]>
Date: Mon, 08 Sep 2008 22:24:16 -0400

Dean,

On the surface, I deem your objection to be without merit. Unless you
can convince me otherwise, I will send
draft-ietf-dnsop-reflectors-are-evil to the RFC editor for publication
on Friday, September 5. See below for point by point responses.

Dean Anderson wrote:
> has previously made falseFrom [email-masked]  Mon Sep  8 19:24:34 2008
Date: Mon, 08 Sep 2008 22:24:16 -0400
From: Ron Bonica <[email-masked]>
To: Dean Anderson <[email-masked]>
Cc: Peter Koch <[email-masked]>, IETF DNSOP WG <[email-masked]>, [email-masked]
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

Dean,

On the surface, I deem your objection to be without merit. Unless you
can convince me otherwise, I will send
draft-ietf-dnsop-reflectors-are-evil to the RFC editor for publication
on Friday, September 5. See below for point by point responses.

Dean Anderson wrote:
> has previously made fal statements deceiving the public and network

Do you deny that the vulnerabilities described in this document *could*
be exploited? If this is your claim, and you can substantiate it, the WG
will entertain your objection.

However, if you are arguing any or all of the following, the WG will not
entertain your objection:

- that there have only been two attacks
- that these attacks were contrived
- that the organization reporting these attacks is not credible
- that the organization reporting these attacks has not satisfied your
requests for evidence
- that there are easier ways to attack DNS

This is because vulnerabilities need to be mitigated, regardless of
whether they have been exploited.

> widespread ISP support for, or call for, this document.

Please see the minutes from IETF 67. It appears that most comments were
accepted and addressed in subsequent versions of the draft. The WG chair
 appropriately determined that another WG last call was not required.

                              Ron

>> ose statements deceiving the public and network

Do you deny that the vulnerabilities described in this document *could*
be exploited? If this is your claim, and you can substantiate it, the WG
will entertain your objection.

However, if you are arguing any or all of the following, the WG will not
entertain your objection:

- that there have only been two attacks
- that these attacks were contrived
- that the organization reporting these attacks is not credible
- that the organization reporting these attacks has not satisfied your
requests for evidence
- that there are easier ways to attack DNS

This is because vulnerabilities need to be mitigated, regardless of
whether they have been exploited.

> widespread ISP support for, or call for, this document.

Please see the minutes from IETF 67. It appears that most comments were
accepted and addressed in subsequent versions of the draft. The WG chair
 appropriately determined that another WG last call was not required.

                              Ron

>>f WG consensus being maintained.  That said, any further discussion of

---

From: Dean Anderson <[email-masked]>
Date: Tue, 9 Sep 2008 10:01:57 -0400 (EDT)

> will entertain your objection.

I'm asserting that whatever vulnerabilities that do exist can be
mitigated in ordinary ways without closing open recursors, including by
BCP38.

> whether they have been exploited.

All protocols have theoretical vulnerabilities.  Your assertion that
"vulnerabilities need to be mitigated, regardless of whether they have
been exploited" is without basis. ICMP PING can be exploited, and is not
especially mitigated by the IETF.  Whatever vulnerabilities posed by
open recursors can be mitigated in other, cheaper ways, without closing
open recursors.  This document, (and the specific action it states:
closing open recursors) is not necessary to mitigate open recursor
abuse.  Open recursors have legitimate users and legitimate uses,
especially in light of recent cache poisoning attacks. One does not want
to trust someone else's recursor.  Closing open recursors has an
significant expense in security and cost of new servers, From [email-masked]  Tue Sep  9 07:02:04 2008
Date: Tue, 9 Sep 2008 10:01:57 -0400 (EDT)
From: Dean Anderson <[email-masked]>
To: Ron Bonica <[email-masked]>
Cc: Peter Koch <[email-masked]>, "Contreras,
	Jorge" <[email-masked]>,
	IETF DNSOP WG <[email-masked]>, [email-masked]
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

> will entertain your objection.

I'm asserting that whatever vulnerabilities that do exist can be
mitigated in ordinary ways without closing open recursors, including by
BCP38.

> whether they have been exploited.

All protocols have theoretical vulnerabilities.  Your assertion that
"vulnerabilities need to be mitigated, regardless of whether they have
been exploited" is without basis. ICMP PING can be exploited, and is not
especially mitigated by the IETF.  Whatever vulnerabilities posed by
open recursors can be mitigated in other, cheaper ways, without closing
open recursors.  This document, (and the specific action it states:
closing open recursors) is not necessary to mitigate open recursor
abuse.  Open recursors have legitimate users and legitimate uses,
especially in light of recent cache poisoning attacks. One does not want
to trust someone else's recursor.  Closing open recursors has an
significant expense in security and cost of new servers, anand should be
well-justified.

Your assertion that false statements, contrived attacks, discredited
sources, and lack of evidence of harm, are somehow not legitimate
reasons to dispute a document is also without basis, and indeed is
refuted by IESG actions in TLS-AUTHZ.

The fabrications made for this document amount to fraud on the public.

It appears that proponents of this document are _encouraging_
exploitation of open recursors in the Rapid Enumeration Tool.  (see
www.dnssec.net/software)  The 'recursors-are-evil' document is just a
fraudulent scheme to sell DNSSEC software.

  Rapid Enumeration Tool (RET) by Nominet UK

--------------------------------------------------------------------------------
The Rapid Enumeration Tool (RET) is designed to use DNSSEC NSEC records 
to enumerate quickly zone data whilst evading detection by systems which 
might be designed specifically to identify zone enumeration activity. It 
does this by using one or more open recursive resolvers to forward 
queries to the authoritative name servers for the zone. Each resolver is 
configured with its own 'personality', specifying query rates, query 
failure/success ratio, proportions of query types, query name 
decoration, etc. This allows the RET to feed queries to each resolver, 
that are specifically tailored to match the queries that a resolver 
might typically send to the authoritative name server. Unlike other NSEC 
resource record 'walkers', the RET does not explicitly query for NSEC 
RRs to walk the zone. Instead, it combines a 'walker' approach with a 
dictionary attack (combined with a random name generator for more 
awkward cases). This means that discernible artifacts in the pattern of 
queries that arrive at the authoritative servers should be minimised.
 
 -- 
Av8 Internet   Prepared to pay a premium for better 
service? www.av8.net         faster, more reliable, better service
617 344 9000   

d should be
well-justified.

Your assertion that false statements, contrived attacks, discredited
sources, and lack of evidence of harm, are somehow not legitimate
reasons to dispute a document is also without basis, and indeed is
refuted by IESG actions in TLS-AUTHZ.

The fabrications made for this document amount to fraud on the public.

It appears that proponents of this document are _encouraging_
exploitation of open recursors in the Rapid Enumeration Tool.  (see
www.dnssec.net/software)  The 'recursors-are-evil' document is just a
fraudulent scheme to sell DNSSEC software.

  Rapid Enumeration Tool (RET) by Nominet UK

--------------------------------------------------------------------------------
The Rapid Enumeration Tool (RET) is designed to use DNSSEC NSEC records 
to enumerate quickly zone data whilst evading detection by systems which 
might be designed specifically to identify zone enumeration activity. It 
does this by using one or more open recursive resolvers to forward 
queries to the authoritative name servers for the zone. Each resolver is 
configured with its own 'personality', specifying query rates, query 
failure/success ratio, proportions of query types, query name 
decoration, etc. This allows the RET to feed queries to each resolver, 
that are specifically tailored to match the queries that a resolver 
might typically send to the authoritative name server. Unlike other NSEC 
resource record 'walkers', the RET does not explicitly query for NSEC 
RRs to walk the zone. Instead, it combines a 'walker' approach with a 
dictionary attack (combined with a random name generator for more 
awkward cases). This means that discernible artifacts in the pattern of 
queries that arrive at the authoritative servers should be minimised.
 
 -- 
Av8 Internet   Prepared to pay a premium for better 
service? www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Ron Bonica <[email-masked]>
Date: Tue, 09 Sep 2008 12:21:28 -0400

Folks,

Someone on DNSOPS points out that I am calendar challenged. September 5
has already past. I meant to say Friday, September 12.

                                  Ron

Ron Bonica wrote:
>> reFrom [email-masked]  Tue Sep  9 09:25:38 2008
Date: Tue, 09 Sep 2008 12:21:28 -0400

Folks,

Someone on DNSOPS points out that I am calendar challenged. September 5
has already past. I meant to say Friday, September 12.

                                  Ron

Ron Bonica wrote:
>> recucursors being used in attacks. That asserted fact was the motivation
>>> You can visit thrsors being used in attacks. That asserted fact was the motivation
>>> You can visit the e changes (non-editorial only affecting the security

changes (non-editorial only affecting the security

---

From: Ron Bonica <[email-masked]>
Date: Tue, 09 Sep 2008 13:00:09 -0400

Dean,

I think that this is the main crux of your argument. If I read you
correctly, you are saying that the vulnerability does exist, but it can
be mitigated by the universal deployment of ingress filtering (BCP 38).

If this is the case, I believe that the document in question should be
published. While I respect the guidance provided in BCP 38, I am fully
aware that many ISPs have not deployed ingress filters and are not
likely to do so in the future. Therefore, we need to develop mitigations
that work in the real world, where weFrom [email-masked]  Tue Sep  9 10:01:54 2008
Date: Tue, 09 Sep 2008 13:00:09 -0400
From: Ron Bonica <[email-masked]>
To: Dean Anderson <[email-masked]>
Cc: Peter Koch <[email-masked]>, "Contreras,
	Jorge" <[email-masked]>,
	IETF DNSOP WG <[email-masked]>, [email-masked]
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

Dean,

I think that this is the main crux of your argument. If I read you
correctly, you are saying that the vulnerability does exist, but it can
be mitigated by the universal deployment of ingress filtering (BCP 38).

If this is the case, I believe that the document in question should be
published. While I respect the guidance provided in BCP 38, I am fully
aware that many ISPs have not deployed ingress filters and are not
likely to do so in the future. Therefore, we need to develop mitigations
that work in the real world, where we c cannot rely on the universal
deployment of BCP 38.

> significant expense in security and cost of new servers, and should be
> well-justified.

If you believed that there were better mitigations, you should have
written a competing draft years ago when the issue was under
consideration. At this point, it is a little late in the process to jump
up and say "I have a better idea!".

If you think that you have an alternative plan for mitigating this
attack, you might be able to resurrect open resolvers with a new draft
that describes this mitigation.

<The conversation goes downhill from here...>

> refuted by IESG actions in TLS-AUTHZ.

I stand by my previous statement. This is a technical argument and not
an argument about the moral status of any group or individual.

> The fabrications made for this document amount to fraud on the public.

Be careful about this kind of statement. In any interesting technical
discussion, we all run the risk of being wrong. I'm wrong sometimes and
 I am sure that you are wrong sometimes, too.

When you make this kind of statement and you end up being wrong, you
have committed a grave offense!

> fraudulent scheme to sell DNSSEC software.

You can't have it both ways. On one hand, you are saying that the
vulnerability isn't significant because it is easily mitigated and on
the other hand you are complaining about those bad guys who aren't
keeping it low enough profile. If it's so easy to mitigate, why do you
care whether knowledge of the vulnerability goes public?

                                   Ron

annot rely on the universal
deployment of BCP 38.

> significant expense in security and cost of new servers, and should be
> well-justified.

If you believed that there were better mitigations, you should have
written a competing draft years ago when the issue was under
consideration. At this point, it is a little late in the process to jump
up and say "I have a better idea!".

If you think that you have an alternative plan for mitigating this
attack, you might be able to resurrect open resolvers with a new draft
that describes this mitigation.

<The conversation goes downhill from here...>

> refuted by IESG actions in TLS-AUTHZ.

I stand by my previous statement. This is a technical argument and not
an argument about the moral status of any group or individual.

> The fabrications made for this document amount to fraud on the public.

Be careful about this kind of statement. In any interesting technical
discussion, we all run the risk of being wrong. I'm wrong sometimes and
 I am sure that you are wrong sometimes, too.

When you make this kind of statement and you end up being wrong, you
have committed a grave offense!

> fraudulent scheme to sell DNSSEC software.

You can't have it both ways. On one hand, you are saying that the
vulnerability isn't significant because it is easily mitigated and on
the other hand you are complaining about those bad guys who aren't
keeping it low enough profile. If it's so easy to mitigate, why do you
care whether knowledge of the vulnerability goes public?

                                   Ron

---

From: Ron Bonica <[email-masked]>
Date: Tue, 09 Sep 2008 13:47:15 -0400

Bill,

> that describes this mitigation.

Also, if Dean feels that the alternative mitigation is so compelling
that he could muster WG consensus around it, he has until this Friday to
describe the mitigation on the mailing list.

                                      Ron

[email-masked] wrote:
> On Tue, Sep 09, 2008 at 01:00:09PM -0400, Ron Bonica wrote:
> 	Ron,
> 		This is not the first time I've heard that arguement and it
> 	-always- strikes me as being dismissive and ignoring potential contribution.
> 	To develop and grow, one must encourage new ideas and rethinking oFrom [email-masked]  Tue Sep  9 10:48:33 2008
Date: Tue, 09 Sep 2008 13:47:15 -0400
From: Ron Bonica <[email-masked]>
To: [email-masked]
Cc: IETF DNSOP WG <[email-masked]>, "Contreras,
	Jorge" <[email-masked]>,
	Peter Koch <[email-masked]>, [email-masked]
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

Bill,

> that describes this mitigation.

Also, if Dean feels that the alternative mitigation is so compelling
that he could muster WG consensus around it, he has until this Friday to
describe the mitigation on the mailing list.

                                      Ron

[email-masked] wrote:
> On Tue, Sep 09, 2008 at 01:00:09PM -0400, Ron Bonica wrote:
> 	Ron,
> 		This is not the first time I've heard that arguement and it
> 	-always- strikes me as being dismissive and ignoring potential contribution.
> 	To develop and grow, one must encourage new ideas and rethinkingld ones
> 	because the underlaying assumptions might have changed.  I'm persuaded 
> 	that its never too late to jump up and say 'I (think) I have a better idea!'
> 
> --bill
> 

 old ones
> 	because the underlaying assumptions might have changed.  I'm persuaded 
> 	that its never too late to jump up and say 'I (think) I have a better idea!'
> 
> --bill
>

---

From: Dean Anderson <[email-masked]>
Date: Tue, 9 Sep 2008 15:15:57 -0400 (EDT)

> describe the mitigation on the mailing list.

Mitigation of open resolver attacks is well described, both by BCP38 and 
by the previous comparision with the more damaging DNS attack.

If one is attacked by open recursors, the mitigation during the attack
is to filter the packets from the open recursors during the attack.  
Filtering open recursors usually has little or no damage to either the
recursor operator or the target of the attack. This is the typical
response by ISPs to all kinds of packet flooding attacks. There is
nothing special about open recursor attacks that requires any kind of
special handling.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 9 Sep 2008 15:15:57 -0400 (EDT)

--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 9 Sep 2008 15:33:53 -0400 (EDT)

> an argument about the moral status of any group or individual.

We agree!  Well, probably not:  I haven't made any argument based on the
moral status of any individual. The existance of false statements,
contrived attacks, discredited sources, and lack of evidence of harm,
are technical issues concerning the actual state of the world. They are
not moral issues; I offer no moral judgements.

> have committed a grave offense!

I've studied the law on the subject of defamation in detail.  Truth is
an absolute defense.

> > www.dnssec.net/software)  The 'recursors-are-evil' document is just
> > a fraudulent scheme to sell DNSSEC software.
> 

Actually, its you who are trying to have it both ways. Proponents claim
that the attack is a real threat, but in fact, they are encouraging
people to conduct the attack.  Lawyers call that "solicitation".  The
"attacks" using open recursors are contrived, SOLICITED, by the people
advocating the closure of open recursors, and SELLING DNSSEC software.

My position is consistent: Even though proponents are soliciting the
attacks, the attacks are still easily mitigated, and in fact do not
represent a real threat that requires special handling.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 9 Sep 2008 15:33:53 -0400 (EDT)

--Dean

---

From: Ron Bonica <[email-masked]>
Date: Tue, 09 Sep 2008 16:19:47 -0400

Dean,

Thanks for this proposal. At his point, I will sit quietly for a while
and let the WG comment on whether they think that your proposed
alternative mitigation is adequate. On Friday, the WG chairs will gauge
consensus and I will take appropriate action.

                              Ron

Dean Anderson wrote:

>From [email-masked]  Tue Sep  9 13:20:38 2008
Date: Tue, 09 Sep 2008 16:19:47 -0400
From: Ron Bonica <[email-masked]>
To: Dean Anderson <[email-masked]>
Cc: IETF DNSOP WG <[email-masked]>, [email-masked], "Contreras,
	Jorge" <[email-masked]>,
	Peter Koch <[email-masked]>, [email-masked]
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

Dean,

Thanks for this proposal. At his point, I will sit quietly for a while
and let the WG comment on whether they think that your proposed
alternative mitigation is adequate. On Friday, the WG chairs will gauge
consensus and I will take appropriate action.

                              Ron

---

From: Dean Anderson <[email-masked]>
Date: Tue, 9 Sep 2008 16:29:19 -0400 (EDT)

> I've studied the law on the subject of defamation in detail.  Truth is

Here is the Black's Law definition of "Actionable Fraud": 

http://www.av8.net/IETF-watch/Definitions/ActionableFraud.html

Actionable fraud. 
Deception practiced in order to induce another to part with property or 
surrender some legal right. A false representation made with intention 
to deceive; such may be committed by stating what is known to be false 
or by professing knowledge of the truth of a statement which is false, 
but in either case, the essential ingredient is a falsehood uttered with 
intent to deceive. To constitute "actionable fraud," it must appear that 
defendant made a material representation; that it was false; that when 
he made it he knew it it was false, or made it recklessly without any 
knowledge of its truth and as a positive assertion; that he made it with 
intention that it should be acted on by plaintiff; that plaintiff 
thereby suffered injury. Essential elements are representation, falsity, 
scienter, deception, reliance, and injury.

So, I'll break it down:

Material representation: That open recursors are being used in DDOS
attacks and that this presents a real threat to network operations.

Falsity: No evidence beyond the contrived and solicited attacks has been
reported.

Scienter: Claims of serious attacks are made without knowledge of the
truth, as a positive assertion.

Deception: intent is that the IETF and IETF members believe and act on
this false information.

Reliance: The IETF and IETF members rely on the statements as truthful,
and base business plans on those statements (they plan to close open
recursors, perhaps plan to buy additional hardware and software)

Injury: The IETF and IETF members spend money to close open recursors
and purchase hardware and software they do not actually need to run
closed recursive servers.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Tue, 9 Sep 2008 16:29:19 -0400 (EDT)

Actionable fraud. 

So, I'll break it down:

		--Dean

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 9 Sep 2008 17:04:25 -0400

On Tue, Sep 09, 2008 at 04:19:47PM -0400, Ron Bonica wrote:

> alternative mitigation is adequate. 

My view is that recommending closing open recursors is a way of
recommending closing one possible DoS path.  It does not close all of
them, and it may not even close the path that is mostly used.  It does
close a path that has been observed in use.  I am sceptical of the
claim that those observations are either fabricated or somehow
fraudulently generated.  I therefore do not think the alternative
mitigation is adequate reason not to go forward with the draft in
question.

A

-- 
Andrew Sullivan
[email-masked]
+1 503 667 4564 x104
http://www.commandprompt.com/
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 9 Sep 2008 17:04:25 -0400

A

---

From: David Conrad <[email-masked]>
Date: Tue, 9 Sep 2008 14:44:20 -0700

[cc's cleaned up]

Hi,

> At his point, I will sit quietly for a while and let the WG comment  
> on whether they think that your proposed
> alternative mitigation is adequate. On Friday, the WG chairs will  
> gauge consensus and I will take appropriate action.

Given the stunningly successful implementation of BCP038 over the 8  
years since it has been published, I believe relying on it as a  
mitigation strategy against open resolver attacks is simply silly and  
discussing it largely a waste of time.

Regards,
-drc

---

From: David Conrad <[email-masked]>
Date: Tue, 9 Sep 2008 14:44:20 -0700

[cc's cleaned up]

Hi,

Regards,
-drc

---

From: Mark Andrews <[email-masked]>
Date: Wed, 10 Sep 2008 09:47:03 +1000

In message <[email-masked]>, David Conrad
> discussing it largely a waste of time.

While I encourage everyone to deploy BCP 38, wherever possible, I
don't believe we should be relying on BCP 38 deployment to prevent
recursive servers being abused.

Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]
_______________________________________________
DNSOP mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/dnsop

---

From: Mark Andrews <[email-masked]>
Date: Wed, 10 Sep 2008 09:47:03 +1000

Mark

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 9 Sep 2008 19:54:18 -0400 (EDT)

> recursive servers being abused.

BCP 38 is one tool in the mitigation box, but it doesn't mean that it can 
only be the *only* tool available.  So I agree with Mark.

wfms

---

From: "William F. Maton Sotomayor" <[email-masked]>
Date: Tue, 9 Sep 2008 19:54:18 -0400 (EDT)

wfms

---

From: Kevin Darcy <[email-masked]>
Date: Tue, 09 Sep 2008 20:41:05 -0400

> only be the *only* tool available.  So I agree with Mark.
First layer of defense: BCP 38

Second layer of defense (because thFrom [email-masked]  Tue Sep  9 17:41:04 2008
Date: Tue, 09 Sep 2008 20:41:05 -0400
From: Kevin Darcy <[email-masked]>
To: DNSOP WG <[email-masked]>
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

> only be the *only* tool available.  So I agree with Mark.
First layer of defense: BCP 38

Second layer of defense (because there are those who cannot or will not 
implement the first layer): Restrict recursive service by default

Third layer of defense (because there are those who cannot or will not 
implement the first or second layers): Reactively filter abusive 
recursors (as Dean suggested).

- Kevin

ere are those who cannot or will not 
implement the first layer): Restrict recursive service by default

Third layer of defense (because there are those who cannot or will not 
implement the first or second layers): Reactively filter abusive 
recursors (as Dean suggested).

- Kevin

---

From: Dean Anderson <[email-masked]>
Date: Wed, 10 Sep 2008 11:33:20 -0400 (EDT)

> implement the first layer): Restrict recursive service by default

If you mean 'restrict software configuration defaults', I'm OK with
that.

If the draft is amended to only recommend that vendors should alter
their _default_ software configuration, then I will not object to the
draft.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Wed, 10 Sep 2008 11:33:20 -0400 (EDT)

--Dean

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Thu, 11 Sep 2008 09:21:19 +0200

(CC trimmed)

Having worked for a tier-1 provider and started two ISPs in the past,  
I am certain that BCP38 won't be universally deployed as that is  
operationally very hard and costly in larger networks. This  
effectively means that there will still be attack vectors open using  
recursive reflectors. Attacks using open recursors are real. I wish I  
could share data or evidence, but as is usually the case in security  
operations, people are not very happy to share the details. The best  
we have is what I assume is the data point from the largest commercial  
observer and regular study (Danny's survey) from the global operations  
forums. Dean has already decided that to disregard that data, so I  
have no idea what other public source of data he would trust.

I support the publication of the document.

- - kurtis -

On 9 sep 2008, at 22.19, Ron Bonica wrote:

> gauge

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Thu, 11 Sep 2008 09:21:19 +0200

(CC trimmed)

- - kurtis -

---

From: Dean Anderson <[email-masked]>
Date: Thu, 11 Sep 2008 15:49:51 -0400 (EDT)

On Thu, 11 Sep 2008, Kurt Erik Lindqvist wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> 
> (CC trimmed)
> 
> recursive reflectors. 

BCP38 non-deployment means that there will be all kinds of spoofed
source IP address attacks, not just open recursor attacks. 

I have personal experience with some rooted systems, recently. The
botnet software that I've seen on these rooted systems doesn't include
programs for exploiting open recursors.

> Attacks using open recursors are real. 

I don't dispute there have been open recursor attacks. However the
attacks appear to be contrived and solicited, lacking in number,
lacking in intensity, and lacking in actual damage.

There is no problem that needs to be solved. There is serious 'unclean 
hands' on the proponents for having solicited attacks, and for profiting 
from closing open recursors with DNSSEC software sales.

> I wish I could share data or evidence, but as is usually the case in
> security operations, people are not very happy to share the details.

Secret evidence that no one can share, and secret harms that no one has
ever reported in the press or in security forums.  Maybe we can have a
super-secret 'recursors-are-evil' document that is never published, 
because the problem is so secret.

> The best we have is what I assume is the data point from the largest
> commercial observer and regular study (Danny's survey) from the global
> operations forums. Dean has already decided that to disregard that
> data, so I have no idea what other public source of data he would
> trust.

NANOG represents a tiny minority of the internet operations community,
just in North America. As has already been pointed out, ARIN has about
3000 members, and NANOG represents a few hundred. NANOG has previously
deceived the public on similar matters.
http://www.iadl.org/nanog/nanog-story.html

If this is a real problem, there should be some clamor from the 
thousands of ISPs worldwide.  There is no such clamor.  There is only a 
clamor from some DNSSEC advocates who have solicited open recursor 
attacks. Some of these folks have also previously deceived the public on 
similar matters, see http://www.iadl.org/maps/maps-story.html.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Thu, 11 Sep 2008 15:49:51 -0400 (EDT)

--Dean

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Fri, 12 Sep 2008 13:38:43 +0200

> source IP address attacks, not just open recursor attacks.

Not will be - is.

> programs for exploiting open recursors.

I am not sure that your rooted systems are representative for the  
general case. I am not sure I would draw conclusions based on a few  
rooted systems either btw...

> lacking in intensity, and lacking in actual damage.

People working in the field seems to think otherwise.

>> security operations, people are not very happy to From [email-masked]  Fri Sep 12 04:39:34 2008
From: Kurt Erik Lindqvist <[email-masked]>
To: Dean Anderson <[email-masked]>
Date: Fri, 12 Sep 2008 13:38:43 +0200
Cc: Ron Bonica <[email-masked]>, IETF DNSOP WG <[email-masked]>,
	"IESG \(\(E-mail\)\)" <[email-masked]>
Subject: Re: [DNSOP] I-D Action:draft-ietf-dnsop-reflectors-are-evil-06.txt
Sender: [email-masked]

> source IP address attacks, not just open recursor attacks.

Not will be - is.

> programs for exploiting open recursors.

I am not sure that your rooted systems are representative for the  
general case. I am not sure I would draw conclusions based on a few  
rooted systems either btw...

> lacking in intensity, and lacking in actual damage.

People working in the field seems to think otherwise.

>> security operations, people are not very happy tshare the details.
>

At least the security forums that I have access to seems to indicate  
otherwise. They are not public or open though......

> deceived the public on similar matters.

 From what I remember you are the one that keep saying Danny based the  
report on some sort of Nanog data while Danny said the report was  
based on data from all operator forums. The world is larger than the  
US...

The above said, as you obviously do not have access to the attack data  
collected at operators, I believe we should just agree to disagree.

Best regards,

- - kurtis -

o share the details.
> because the problem is so secret.

At least the security forums that I have access to seems to indicate  
otherwise. They are not public or open though......

> deceived the public on similar matters.

 From what I remember you are the one that keep saying Danny based the  
report on some sort of Nanog data while Danny said the report was  
based on data from all operator forums. The world is larger than the  
US...

The above said, as you obviously do not have access to the attack data  
collected at operators, I believe we should just agree to disagree.

Best regards,

- - kurtis -

---

From: Dean Anderson <[email-masked]>
Date: Fri, 12 Sep 2008 13:52:31 -0400 (EDT)

> People working in the field seems to think otherwise.

What people? There are 3000 or so members of ARIN. There must be tens of
thousands over all the registries.  Where are these thousands of ISPs
handling DNS open recursors attacks?  The (very) few people opposed to
open recursors either stand to sell DNSSEC software or support it, or
are known to have participated in similar deceptions.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Fri, 12 Sep 2008 13:52:31 -0400 (EDT)

--Dean