Subject: [savi] DNS-spoofing (fwd)

From: Pekka Savola <[email-masked]>
Date: Fri, 1 Aug 2008 13:27:50 +0300 (EEST)

This may be of interest here -- if the enterprise or ISP provides a 
DNS resolver on the same link as hosts, current anti-spoofing 
solutions won't work (however, the DNS server's host firewall could 
have some ACL on the interface), and a SAVI solution could be useful.

---------- Forwarded message ----------
Date: Thu, 31 Jul 2008 20:47:12 +0200
From: Patrik Wallstrom <[email-masked]>
To: [email-masked]
Subject: DNS-spoofing

John Dickinson demonstrated on the dnsext wg meeting today that you can spoof a 
local DNS reslover in 95ms. The resolver had a fixed source port.

-- 
patrik_wallstrom->foodfight->[email-masked]>+46-733173956

---

From: Sean Donelan <[email-masked]>
Date: Sat, 2 Aug 2008 23:34:13 -0400 (EDT)

On Fri, 1 Aug 2008, Pekka Savola wrote:
> This may be of interest here -- if the enterprise or ISP provides a DNS 
> resolver on the same link as hosts, current anti-spoofing solutions won't 
> work (however, the DNS server's host firewall could have some ACL on the 
> interface), and a SAVI solution could be useful.

There are current (although not always standardized) anti-spoofing 
solutions for most types of local network technology.  Some ISPs already 
prevent other customers from any spoofing addresses on the same link, and 
enterprises can use similar technology to prevent internal hosts on the 
same network from spoofing external (and hopefully other internal) 
addresses.  Default settings and painful configuration means they aren't
always used.

You are correct some local networks, i.e. the traditional thick-coax 
ethernet, probably will always be vulnerable to local spoofing without 
some other controls.  But if you are on a shared thick-coax ethernet,
you can already use promiscious sniffing, and could already generate the 
poisoned DNS reply with one packet.  That's one of the reasons why ISPs
in the 1990's (after a couple of newsworthy incidents) changed their
network architectures, and (should) avoid hosts connected to shared 
data link networks with customer traffic.