Subject: whois and zone enumeration

From: Miek Gieben <[email-masked]>
Date: Tue, 3 Aug 2004 01:03:05 +0200

Hello,

I've a simple question. If a TLD would shutdown their whois service,
would zone enumeration then still be a problem?

(ignoring the fact that you might not want to do this)

grtz,
--Miek

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Tue, 03 Aug 2004 00:57:01 +0000

> Yes.  Elaboration of delegation-only zones is a problem in and of
> itself.  Lists of owner names may be (and, in Nominet's case, have
> been) employed in combination with RFC 2142 local-parts to create
> mailing lists that are subsequently used/sold on for for the purpose
> of UCE.

what we have here is a divergence of vision.  security is not obscurity,
and obscurity is not an intended feature of either "dns classic" or any
extension ever made to dns.

consider that almost any use made of a domain will subject it to public
view, where it can be and will be recorded.  consider that many uses of
this data are benign or even well intended, like measurements or search
engines.  consider that every bad use (UCE, etc) can be and will be made
whether obscurity is used or not.

if you have information you don't want the world to know the name of, then
don't put it in dns at all, or use "split dns" to limit the viewability of
this data to small trusted population such as your intranet.

some say that nsecX is a way to make dns as obscure as pre-dnssec dns was.

i say that the asserted obscurity of pre-dnssec dns was illusory, and that
our "complexity budget" is best used for actual features.

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 2 Aug 2004 19:53:31 -0700

> what we have here is a divergence of vision.  security is not 
> obscurity, and obscurity is not an intended feature of either 
> "dns classic" or any extension ever made to dns.

As a security professional who is engaged as such I can assure
you that it is a very bad idea to remove security controls 
from an existing system unless you understand their effect.

The fact that a control is unintended or is rejected on 
ideological grounds does not mean that it can be dispensed
with. I am currently dealling with the consequences of
an industry abandoning certain controls that were present
in the ATM systems but are not present on the Internet.
As a result I spend a great deal of time talking to
law enforcement.

Removing imperfect security controls without replacing them
is one of the main ways that security protocols fail in 
practice.

Before simply repeating the standard security dogmas that you 
have heard, please understand that they have never been considered
absolute maxims in the security world and those who have tried
to apply them have mostly produced systems that failed.

'Security through obscurity is false security' has been a discredited 
dogma in the security world since it was used to delay the 
introduction of shaddow passwords in UNIX for about three years.
It took the arrival of crack to change minds there.

'End to End security' and 'bad security is worse than no
security' are also considered obsolete in the real security 
world. 

The common sense ideas that preceded the dogmas are still 
generally accepted. But you are advancing a dogmatic interpretation
that is rejected by the field. It certainly has no place in a
security design argument.

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 3 Aug 2004 15:12:20 +0200

On Mon, Aug 02, 2004 at 07:53:31PM -0700,
 Hallam-Baker, Phillip <[email-masked]> wrote 
 a message of 46 lines which said:

> 'Security through obscurity is false security' has been a
> discredited dogma in the security world

Because many people misunderstood it: they thought it meaned "Security
through obscurity is false security and thefore everything should be
published immediately" while it actually means "Security through
obscurity is false security and therefore your security should not
disappear completely when the system is known" (defence in depth: I do
not assume that zone enumeration is impossible, I have other
protections, but it does not mean I post the zone file on an anonymous
FTP server).

---

From: Danny Mayer <[email-masked]>
Date: Tue, 03 Aug 2004 09:53:21 -0400

>from an existing system unless you understand their effect.

I agree with Paul. He is not advocating the removal of anything. He's
saying that depending on obscurity for security is no security at all.

>As a result I spend a great deal of time talking to

You misread his statement.

>is one of the main ways that security protocols fail in

Where did he advocate removing imperfect security controls?

>security design argument.

He's not advancing any dogma. He wants to advance real security.
Preventing zone enumeration through DNSSEC records should not
give the illusion that thereby you are preventing zone enumeration,
just making it more difficult. If the goal is to make it more difficult,
then that should be stated up front.

Danny

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 3 Aug 2004 09:45:08 -0700

I stand by my original statements.

Paul is repeating a dogma he does not understand to make an argument that is
false.

the nsa requested this particular feature five years ago. It made sense then
it does now.

The split dns model is not sufficient for serious security needs. My clients
are concerned about internal threats as well as external. In the age of
mydoom the split dns solution is a weak one. In the age of web services and
deperimeterization it is nonsense.

 -----Original Message-----
From: 	Danny Mayer [mailto:[email-masked]]
Sent:	Tue Aug 03 06:53:43 2004
To:	Hallam-Baker, Phillip; [email-masked]
Subject:	RE: whois and zone enumeration 

Danny