Subject: Re: dictionary attack on nameservers

From: [email-masked]
Date: Mon, 16 Aug 2004 20:11:56 -0700

On Mon, Aug 16, 2004 at 11:44:03PM +0000, Paul Vixie wrote:
> in message <[email-masked]> on 26-may-2004, i wrote:
> 
> | in my day job, i'm in touch with a lot of enterprise dns users, and
                                              ******************** 

Unfortunately, this doesn't tell us anything about "non-enterprise dns
users" -- which I will defins as smaller organizations/businesses that
are big enough to run their own dns, but not big enough to keep heavy
duty dns gurus on their staff. 

[...]

> | if you have information you don't want the world to know the name of,
> | then don't put it in dns at all, or use "split dns" to limit the
> | viewability of this data to small trusted population such as your
> | intranet.

In my experience, "split dns" most frequently accompanies firewalling
of some kind, and thus there are subtantial other considerations in
addition to simply hiding names.  Presuming that there is no
firewalling going on, and that a finer granularity than "insider vs
outsider" is not desired, how is split dns superior to simply denying
axfers?

> so, i'm not sure whether i speak for all domainholders, but certainly "many"
> and i'm still willing to help discover "how many" if there's encouragement
> and if it begins to seem that this is generally relevant "design data".

How would you survey the registrants described above, the 
"non-enterprise dns users"?

Regards
Kent

-- 
[email-masked]    p: +1 310 823 9358  f: +1 310 823 8649
[email-masked] SIP: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: David Blacka <[email-masked]>
Date: Tue, 17 Aug 2004 02:08:04 -0400

On Monday 16 August 2004 7:44 pm, Paul Vixie wrote:
> > How do we move this conversation along?  From your previous comments,
> > it seems that it is nearly impossible for this group to prove (show)
> > or disprove that successful data mining already occurs.
> >
> > It seems like you are saying:
> >   * in order to work on this we must demonstrate A
> >   * it is impossible to demonstrate A
> >
> > Am I wrong?  If not, where do we go from here?
>
> i'm not sure.  i'm one of those to whom "A" (in this example) is trivially
> observable and a well known and well documented fact.  but i am afraid that
> it's not as trivially observable by others as it is by "the antispam
> crowd", and that _objective_ proof might be hard to come by.  i keep hoping
> that we will somehow reach agreement, or find a different basis on which to
> close the gap.  see my separate post today about a possible "datamining
> olympiad".

At this point, I am concerned that what you are talking about and what they 
are talking about does not seem to be the same thing.  (or maybe you are and 
I've just read more into some folks postings than I should've.)

What I hear you (and some others) saying is:
   There is obviously datamining and attacks stemming from that datamining 
now.  Partial (or total?) zone enumeration is possible today using such 
techniques, so: zone enumeration via DNSSECbis will not substantially change 
the threat model present on the Internet.  Thus, it is not worth the 
engineering pain to try and stop it.

What I hear the folks concerned about datamining at the registry/rar level 
saying is:
  There may be datamining, but we don't want to be part of the problem.  
DNSSECbis forces us to be part of the problem.

At some level, I see this argument as:
  * group A says: we have this policy against zone enumeration.  We cannot 
deploy DNSSECbis because of it.
  * group B says: your policy is stupid, change it.

Either we need to convince group A that their policy is, in fact, stupid, or 
we need to solve the problem.  Or just leave them behind.

> > Trying to find the disconnect here: clearly folks who are worried
> > about zone enumeration do not believe that zone enumeration via data
> > mining is currently successful (for some definition of successful),
> > and they clearly think there is a substantial difference between
> > getting some fraction of a zone and the whole thing.

Just to press down a bit further: do you see no substantial difference between 
being able to get 100% of a zone vs. getting perhaps 80% via datamining?  
This is, I think, a major disconnect.  

I know that in my own experience I've seen malefactors using readily available 
TLD zone files to find newly registered domain to make their own activities 
more efficient.

> > I also think that there are somewhat compelling arguments that this
> > *isn't* just a problem for a small number of registries and
> > registrars.  It is clear that you, as a domainholder, don't care, but
> > can you speak for all of the other domainholders?

> so, i'm not sure whether i speak for all domainholders, but certainly
> "many" and i'm still willing to help discover "how many" if there's
> encouragement and if it begins to seem that this is generally relevant
> "design data".

I don't know how relevant it is.  At this point, it is mostly just part of 
your argument, and this part of the argument would be more compelling if it 
were less anecdotal.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    Verisign Applied Research

---

From: Alex Bligh <[email-masked]>
Date: Tue, 17 Aug 2004 08:41:37 +0100

--On 16 August 2004 23:44 +0000 Paul Vixie <[email-masked]> wrote:

> observable

Let me get this straight: you are saying a dictionary attack (or some other
enumeration attack) on say .de (or .uk or .nl) is "trivially observable",
but despite its triviality, you haven't posted any data to support it? Can
you post the exact methodology and how many names from (say) .de can you
recover using this method?

I am prepared to accept David Blacka's contention (if I understand it) that
it is impossible to either prove that an effective attack either can or
cannot currently occur (or rather that it's difficult so to prove/disprove)
but if your position is that it is possible to prove it by trivial example,
let's see it.

If David is right, then at the most generous, DNSSEC enumerability turns
a risk of effective enumerability into a certainty.

Alex

---

From: [email-masked]
Date: Tue, 17 Aug 2004 11:23:28 +0000

> it is impossible to either prove that an effective attack either can or
                                           _________
	Alex, you/we apparently do not share a common view of what
	is "effective" and I expect that Paul's "blackhat" community
	has the same problem.  Effective is in the eye of the user.
	2% successful enumeration may be effective for some while 95%
	enumeration is not successful for others.  Then there are
	the other, obliquely mentioned factors that must be considered:

	) zone size.  2% of a 70million entry zone might be ok, while 2% of
	              a zone of 10 entries might be less useful.
	) zone "churn".   the persistance of zone entries is a trigger for
	              how effective "slow-scan" enumeration is.  If I can 
	              be assured that data I collected in 1997 is still going
		      to be in the zone, I can focus on enumerating the parts of 
		      the zone that are more dynamic. 

	mitigation of enumeration capability isa slippery slope.  where are the 
	boundaries?   AXFR may be one end - normal queries at the other. before 
	spending excessive time on designing a technical solution, can folks pick
	a defenseable point on the slope?  

	(blocking AXFR has a defensable point, but only for very large zones.  keeping
	TCP sessions open for hours to move a 70m entry zone is likely a bad idea, esp
	when the zone changes every 15 minutes.  This is a reason to block AXFRs)

> Alex

--bill

---

From: "D. J. Bernstein" <[email-masked]>
Date: 29 Aug 2004 03:55:43 -0000

Paul Vixie writes:
> what's trivially observable is that the names are not remaining secret,

Here's an interesting picture of a tree:

   53145ddd853407645babda07a9dd2b63.pictures.cr.yp.to

Right now there are 1488 other pictures available from the same server.
You claim that the names aren't secret. Show us the pictures!

---D. J. Bernstein, Associate Professor, Department of Mathematics,
Statistics, and Computer Science, University of Illinois at Chicago