Subject: Re: [savi] DNS-spoofing (fwd)

From: "Paul Ferguson" <[email-masked]>
Date: Sun, 3 Aug 2008 03:52:59 GMT

- -- Sean Donelan <[email-masked]> wrote:

>On Fri, 1 Aug 2008, Pekka Savola wrote:
>> This may be of interest here -- if the enterprise or ISP provides a DNS 
>> resolver on the same link as hosts, current anti-spoofing solutions
>> won't  work (however, the DNS server's host firewall could have some ACL
>> on the  interface), and a SAVI solution could be useful.
>
>There are current (although not always standardized) anti-spoofing 
solutions for most types of local network technology.  Some ISPs already 
prevent other customers from any spoofing addresses on the same link, and 
enterprises can use similar technology to prevent internal hosts on the 
same network from spoofing external (and hopefully other internal) 
addresses.  Default settings and painful configuration means they aren't
always used.
>
>You are correct some local networks, i.e. the traditional thick-coax 
ethernet, probably will always be vulnerable to local spoofing without 
some other controls.  But if you are on a shared thick-coax ethernet,
you can already use promiscious sniffing, and could already generate the 
poisoned DNS reply with one packet.  That's one of the reasons why ISPs
in the 1990's (after a couple of newsworthy incidents) changed their
network architectures, and (should) avoid hosts connected to shared 
data link networks with customer traffic.

So I'm not really sure what your point is here, Sean...

Are you arguing that source-address validation is somehow unneeded,
or perhaps that existing technologies already exist to fix the
problem? If so, then I think that the SAVI WG is indeed correct
in stating that "While ingress filtering [RFC 2827, BCP 38] provides
a way to validateIP source addresses at an aggregated level, there
is not yet a standardized mechanism for IP source address validation
at a finer granularity."

I think that SAVI is beneficial in the case of DNS spoofing issues,
too.

If you don't agree, I think you may be in the minority here.

- - ferg

--
"Fergie", a.k.a. Paul Ferguson
 Engineering Architecture for the Internet
 fergdawg(at)netzero.net
 ferg's tech blog: http://fergdawg.blogspot.com/

---

From: Sean Donelan <[email-masked]>
Date: Sun, 3 Aug 2008 01:11:33 -0400 (EDT)

> If you don't agree, I think you may be in the minority here.

You have re-stated exactly what I said.  There is not a standardized
method.

Lack of a standard doesn't mean you should wait to do something now.

SAVI will be useful in the future.  In the mean time, please don't
wait to read the vendor manuals and use whatever non-standardized
tools exist.