Subject: RE: Pimping DNSSEC (was Re: DNSSEC - Signature Only vs the MX/A issue.)

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 5 Dec 2006 20:16:05 -0800

> From: Danny Mayer [mailto:[email-masked]] 

> I suspect that we will see demand for DNSSEC the first time 
> that a bank sees a poisoning attack and their customers get 
> redirected to a fake site and their accounts drained as a 
> result. Phishing attacks can be alleviated since you can tell 
> technologically that the site is not what it claims. Their 
> customers will demand it, the bank will be afraid not to do 
> it, the insurance companies make it a condition of coverage 
> of losses, etc. Then of course the military have a need for 
> it. Of course that still leaves the issue of validating 
> resolvers being not being widely deployed (okay, so only a 
> handful of people have deployed them).

This attack is happening but not quite in this way.

A spoofing attack only affects a local area. Seems that the use being made by the perpetrators of DNS spoofing is to drive folk to fake versions of CNN etc. and try to load a trojan onto their machine.

A stolen CC number is worth less than a dollar. Downloading the trojan has a higher success rate and pays out rather more. 

The trojan could be a keystroke logger, a redialer or just recruit as a bot.

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Joe Abley <[email-masked]>
Date: Wed, 6 Dec 2006 09:03:21 -0500

> This attack is happening but not quite in this way.

The banks around here have fixed that problem by buying insurance  
which will reimburse both the bank and the customer from fraudulent  
transactions which occur using the bank's web banking app.

In the case that the customer notices a fraudulent transaction, the  
bank reimburses them, the insurance company reimburses them, and  
everybody is happy.

In the case that the customer doesn't notice a fraudulent  
transaction, nobody does anything and everybody is still happy.

DNSSEC will need to be as reliable as this, and noticably cheaper  
than the insurance, before I would expect these banks to start caring  
about it.

Joe

---

From: Danny Mayer <[email-masked]>
Date: Mon, 11 Dec 2006 19:15:00 -0500

Joe Abley wrote:
> The banks around here have fixed that problem by buying insurance which
> will reimburse both the bank and the customer from fraudulent
> In the case that the customer notices a fraudulent transaction, the bank
> reimburses them, the insurance company reimburses them, and everybody is
> happy.
> 

Actually, it doesn't take long before the insurance companies start to
push the banks to do something to secure their networks. If a customer
notices then they spread the word and it becomes a public relations
nightmare for the banks if they don't do something. It's not just about
who pays for the problem.

> In the case that the customer doesn't notice a fraudulent transaction,
> nobody does anything and everybody is still happy.
> 
> DNSSEC will need to be as reliable as this, and noticably cheaper than
> the insurance, before I would expect these banks to start caring about it.
> 

Cheaper is not the only incentive, bad publicity is a much larger one.
Customers will move their money somewhere safer if they perceive a problem.

Danny