Subject: Re: was Re: Avoiding collisions

From: Mark Andrews <[email-masked]>
Date: Mon, 20 Sep 2004 08:20:22 +1000

> Edward Lewis <[email-masked]> writes:
> 
> > So far just about all of the "complaining" (for lack of a better 
> > word) about zone enumeration seems to have come from large 
> > registries.  Question: is zone enumeration a more general "problem?"
> 
> Yes.  The risks in smaller zones further down in the domain tree are
> different from the risks in zones higher up in the tree, but they do
> exist.  The citation I like to give, on risks in smaller zones, is:
> 
>   Steven M. Bellovin, "Using the Domain Name System for System Break-Ins", in
>   Proceedings of the Fifth Usenix UNIX Security Symposium, Salt Lake City, UT
> ,
>   June, 1995. http://www.research.att.com/~smb/papers/dnshack.pdf

	This is no so much zone enumeration but lack of security in
	the answers being returned.

	AXFR was in both the solution and problem spaces.  It gave you
	the names but it also allowed the caches to be protected from
	spoofing of replies.  The problem was and still is that AXFR
	doesn't scale and you couldn't know in advance all the names
	that would be added to .rhosts files.

	As with most things enumeration was not just bad or just good
	but a mixture.

	Mark
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>