The Security blogosphere is exploding with chatter today about leaked details of Dan Kaminsky's multi-vendor DNS flaw.
Here is how it works (according to leak):
Malory wants to poison the server ns.polya.com
Malory sends NS requests for ulam00001.com, ulam00002.com … to ns.polya.com.
Malory then sends a forged answers, saying that the NS for http://www.ulam00002.com is ns.google.com *AND* puts a glue record saying that ns.google.com is 66.6.6.6
Because the glue records corresponds with the answer record, (same domain) the targetted nameserver will cache or replace it’s curent record of ns.google.com to be 66.6.6.6
http://addxorrol.blogspot.com/2008/07/on-dans-request-for-no-speculation.html
Make sure to read the comments for details of the original leak (Matasano's blog), the drama is Matasano originally called BS on the flaw forcing Dan to back it up with a phone briefing. Thomas Ptacek then re-tracked his BS claims under the agreement he would keep quiet. Now the same guy leaked the technical details is attempting to apologize... What a jerk.
http://www.matasano.com/log/1105/regarding-the-post-on-chargen-earlier-today/
No comments:
Post a Comment