Subject: Re: dictionary attack on nameservers

From: David Blacka <[email-masked]>
Date: Mon, 16 Aug 2004 15:28:30 -0400

On Monday 16 August 2004 2:34 pm, Paul Vixie wrote:

> i expect that an ambitious and committed data miner would buy spammer
> cdroms, run their own web crawlers, buy the ISC Domain Survey (see
> www.isc.org/ops/ds/) and add both local- and international-language
> common word dictionaries, along with combinations (with and without
> hyphens) and abbreviations and misspellings and all kinds of suffixes
> and prefixes (like number-strings).
>
> the hard part of proving this is that to do a proper job, one would have
> to have the same kind of monetary incentive that a true data miner would
> have.  but that monetary incentive invariably comes with a disincentive
> to publish one's results and methods.

What are we trying to prove, again?  It seems to me that all we need to prove 
is that for a dictionary attack to be "successful", it requires a non-trivial 
amount of effort.  A point which you seem to already concede, and we seem to 
be slowly showing.

I could be wrong, but it seems to me that the folks arguing for protection 
against zone enumeration are just asking that zone enumeration not be made 
worse.  So, if it takes a significant amount of effort to enumerate a zone 
without DNSSEC, and a similarly significant amount of effort to do so with 
DNSSEC, I think they would all be satisfied.

This argument that because a sufficiently creative and determined data miner 
might be able to enumerate a zone today, we should have no problem making it 
trivially easy with NSEC chain walking seems either obtuse or disingenuous to 
me.

-- 
David Blacka    <[email-masked]> 
Sr. Engineer    VeriSign Applied Research

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Paul Vixie <[email-masked]>
Date: Mon, 16 Aug 2004 19:54:40 +0000

> > ...
> What are we trying to prove, again?  It seems to me that all we need
> to prove is that for a dictionary attack to be "successful", it
> requires a non-trivial amount of effort.  A point which you seem to
> already concede, and we seem to be slowly showing.

actually, i don't find "triviality" to be a relevant standard for this.
what i want to know (or even prove or disprove) is whether it's already
being commonly done and whether putting more effort into avoiding "zone
walking" is an instance of the general principle called "closing the barn
door after the animals have already escaped."

for "triviality" to be a relevant standard, we would have to agree that
committed dataminers are less of a privacy threat than uncommitted ones
(and i won't agree that this is true) and also agree that committed data-
miners aren't going to make a market in domain names by offering them to
less committed dataminers (and i won't agree that this is true, either.)

> worse.

you're not wrong.  but "they" could be looking at this the wrong way.  if
zone enumeration is already possible, then what exactly are we hoping to
"buy" by spending global design and implementation costs "preventing" it?
does the incremental benefit outweigh the incremental cost?  are you sure?

> So, if it takes a significant amount of effort to enumerate a zone
> without DNSSEC, and a similarly significant amount of effort to do so
> with DNSSEC, I think they would all be satisfied.

perhaps.  but i would not be satisfied.  knowing that it's going to
happen either way, and knowing that the entities most affected by it
will be a small number of registries and registrars, not domainholders,
and knowing that the incremental costs are dramatically huge, makes me
want a better cost:benefit analysis than has yet been presented here.

> This argument that because a sufficiently creative and determined data
> miner might be able to enumerate a zone today, we should have no
> problem making it trivially easy with NSEC chain walking seems either
> obtuse or disingenuous to me.

see above.

---

From: Edward Lewis <[email-masked]>
Date: Mon, 16 Aug 2004 15:55:21 -0400

>amount of effort.  A point which you seem to already concede, and we seem to

Not to argue, but to demonstrate the confusion over this, it's not 
clear to me that:

    'for a dictionary attack to be "successful", it requires a non-trivial
    amount of effort.'

I stress that I don't know...but I've heard that in these days of 
rooted machines on cable modem networks, "trivial" isn't the issue.

(I used to think the solution to spam was simple - make it more <cpu> 
expensive to send mail.  But if the sender is just 'stealing' 
machines, such a solution is pointless at best.)
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.

---

From: Danny Mayer <[email-masked]>
Date: Mon, 16 Aug 2004 17:54:47 -0400

>want a better cost:benefit analysis than has yet been presented here.

All of this is true, but also remember that the cost/benefit picture is 
constantly
changing as costs of equipment go down, CPU, network speeds go up, domain
names increase and the cost and complexity of deploying DNSSEC goes up
as this gets discussed.

More to the point, what benefit do these people have in getting all these
names/addresses? What do they do with it?

Danny

---

From: David Blacka <[email-masked]>
Date: Mon, 16 Aug 2004 18:58:39 -0400

On Monday 16 August 2004 3:54 pm, Paul Vixie wrote:
> > > ...
> > > the hard part of proving this is that to do a proper job, one would
> > > have to have the same kind of monetary incentive that a true data miner
> > > would have.  but that monetary incentive invariably comes with a
> > > disincentive to publish one's results and methods.
> >

How do we move this conversation along?  From your previous comments, it seems 
that it is nearly impossible for this group to prove (show) or disprove that 
successful data mining already occurs.

It seems like you are saying:
  * in order to work on this we must demonstrate A
  * it is impossible to demonstrate A

Am I wrong?  If not, where do we go from here?

> less committed dataminers (and i won't agree that this is true, either.)

Valid points.  In your mind there is no difference between a world were a few 
determined folks can get maybe 90% of a zone with effort, and a world where 
anyone can get 100% of a zone with virtually no effort?

Note that I, personally, do not feel very strongly about this issue either 
way.  I was just feeling that the current discussion wasn't all that 
productive and was hoping (futilely, probably) to redirect it to a more 
productive path.

> does the incremental benefit outweigh the incremental cost?  are you sure?

Trying to find the disconnect here:  clearly folks who are worried about zone 
enumeration do not believe that zone enumeration via data mining is currently 
successful (for some definition of successful), and they clearly think there 
is a substantial difference between getting some fraction of a zone and the 
whole thing.

> want a better cost:benefit analysis than has yet been presented here.

I would think that a cost/benefit analysis would be useful, but I've also seen 
both side fail to agree on either the costs or the benefits.

I also think that there are somewhat compelling arguments that this *isn't* 
just a problem for a small number of registries and registrars.  It is clear 
that you, as a domainholder, don't care, but can you speak for all of the 
other domainholders?

---

From: David Blacka <[email-masked]>
Date: Mon, 16 Aug 2004 19:05:49 -0400

On Monday 16 August 2004 3:55 pm, Edward Lewis wrote:
> >What are we trying to prove, again?  It seems to me that all we need to
> > prove is that for a dictionary attack to be "successful", it requires a
> > non-trivial amount of effort.  A point which you seem to already concede,
> > and we seem to be slowly showing.
>

I guess "trivial" isn't a precise enough term ;)

But the cost of doing something is always relevant, even now when some 
malefactors can marshall an army of zombies.

---

From: Paul Vixie <[email-masked]>
Date: Mon, 16 Aug 2004 23:44:03 +0000

> How do we move this conversation along?  From your previous comments,
> it seems that it is nearly impossible for this group to prove (show)
> or disprove that successful data mining already occurs.
> 

i'm not sure.  i'm one of those to whom "A" (in this example) is trivially
observable and a well known and well documented fact.  but i am afraid that
it's not as trivially observable by others as it is by "the antispam crowd",
and that _objective_ proof might be hard to come by.  i keep hoping that we
will somehow reach agreement, or find a different basis on which to close the
gap.  see my separate post today about a possible "datamining olympiad".

> ...  In your mind there is no difference between a world were a few
> determined folks can get maybe 90% of a zone with effort, and a world
> where anyone can get 100% of a zone with virtually no effort?

there is some difference, but it's smaller than the difference in cost
between "the 10-year dnssec" and "the 15-year dnssec".

> Trying to find the disconnect here: clearly folks who are worried
> about zone enumeration do not believe that zone enumeration via data
> mining is currently successful (for some definition of successful),
> and they clearly think there is a substantial difference between
> getting some fraction of a zone and the whole thing.

yes.  or they think there's a whole subpopulation of chickenboner dataminers
who don't have the fortitude to gather the data using pre-dnssec methods,
who will jump on the bandwagon once the bar is lowered (to "zone walking"),
and they somehow think the number and kind of attacks they're getting now
is more refined and more deliberate than the kind of attacks they'll get
once the chickenboners are allowed to play.  there may be merit in that, but
i don't expect to see arguments about these "shades of gray".  (in public.)

> I also think that there are somewhat compelling arguments that this
> *isn't* just a problem for a small number of registries and
> registrars.  It is clear that you, as a domainholder, don't care, but
> can you speak for all of the other domainholders?

well, let's open up the ol' archives and take a look-see on that topic.

in message <[email-masked]> on 26-may-2004, i wrote:

| in my day job, i'm in touch with a lot of enterprise dns users, and
| they universally tell me that the data and/or names they consider
| sensitive enough to worry about axfr or zonewalking, would also be
| dangerous for queries, and so they run "split dns" so that only
| internal hosts can see the data.  they've turned off external axfr
| because it's unnecessary, not because it would expose data they care
| deeply about keeping private.  the data they care deeply about keeping
| private is only available "internally."

(i also proposed a survey and offered to run it, but received no words of
encouragement or even acknowledgement that these issues mattered, so i've
done nothing more on this thread to date.)

then later on (3-aug-2004) i wrote:

| consider that almost any use made of a domain will subject it to
| public view, where it can be and will be recorded.  consider that many
| uses of this data are benign or even well intended, like measurements
| or search engines.  consider that every bad use (UCE, etc) can be and
| will be made whether obscurity is used or not.
| 
| if you have information you don't want the world to know the name of,
| then don't put it in dns at all, or use "split dns" to limit the
| viewability of this data to small trusted population such as your
| intranet.

so, i'm not sure whether i speak for all domainholders, but certainly "many"
and i'm still willing to help discover "how many" if there's encouragement
and if it begins to seem that this is generally relevant "design data".

---

From: Jim Reid <[email-masked]>
Date: Tue, 17 Aug 2004 17:41:58 +0100

>>>>> "David" == David Blacka <[email-masked]> writes:

    >> [2] Is it worth the time and effort to "fix" NSEC walking --
    >> and no doubt hold up the deployment of a Secure DNS for maybe
    >> another 5 years -- when this issue only creates *policy*
    >> difficulties for a small number of admittedly very significant
    >> corner cases?

    David> Whose time and effort?  Yours?  No one can force you to
    David> work on the problem.

That's certainly true. Not that I could contribute much anyway. But
this is beside the point. We have a DNS infrastructure that's not
secure. The longer we delay the deployment of DNSSEC (for some
definition of "deployment" and "DNSSEC"), the more likely it is
Something Very Bad will happen. It's only a question of time before
the script kiddies start to attack the DNS.

The current drafts are good enough IMO and it's time the WG took an
engineering decision to stop tinkering with the protocol and got down
to work on the deployment and migration issues.

    David> But the way the question is phrased make me wonder if the
    David> causality is backwards.  The question says that working on
    David> the zone enumeration will hold up DNSSEC deployment.
    David> Maybe, instead, people want to work on the problem because
    David> the problem will hold up DNSSEC deployment.

Hmm: is the glass half-empty or half-full? I suppose it depends where
someone is looking from.

    >> It would also be interesting to find out from the owners of
    >> domain names in .de and .uk what they'd prefer: securing the
    >> DNS for their zones or preventing Bad People from generating a
    >> copy of the TLD.

    David> Don't we know this answer, too?  Clearly, they would rather
    David> not make that choice, but what I hear co.uk saying is that
    David> for now they would prefer to prevent zone enumeration. 

The co.uk policy committee is saying this. Which is not necessarily
the same thing as the punters who have registered domain names under
co.uk. I wonder how many of them will be content that their zones
remain unsecured because the policy committee believes preventing zone
enumeration by NSEC traversal is more important than getting the co.uk
zone signed? "It's a pity you lost millions and alienated your
customers because somebody spoofed the DNS data for BigBank.co.uk. But
don't worry. Spammers can't get a copy of co.uk by walking the
NSECs. That'll make you feel better."

---

From: Paul Vixie <[email-masked]>
Date: Tue, 17 Aug 2004 22:59:42 +0000

> Just to press down a bit further: do you see no substantial difference
> between being able to get 100% of a zone vs. getting perhaps 80% via
> datamining?  This is, I think, a major disconnect.

difference to whom?  to a dataminer, 100% is better than 80%.  to a registry,
100% is worse than 80%.  to a domainholder, it matters whether you're in the
20% or in the 80%, but not very much.

> I know that in my own experience I've seen malefactors using readily
> available TLD zone files to find newly registered domain to make their
> own activities more efficient.

yes, i saw some correlation between COM/NET/ORG AXFR's on f-root (back when
AXFR from f-root was the only way to get this data) and bad acts by bad folks.
but as we've all seen, making it harder isn't the same as stopping bad acts,
or even slowing them down.  (sure does cost the good guys more, though.)