[dns-operations] first (lab) spoof of a fully source port randomised server reported

[Brian Dickson]

Ray.Bellis at nominet.org.uk wrote:
>> http://tservice.net.ru/~s0mbre/blog/devel/networking/dns/2008_08_08.html
>>
>> "Attack took about half of the day, i.e. a bit less than 10 hours.
>>  So, if you have a GigE lan, any trojaned machine can poison your DNS 
>>     
> during
>   
>>  one night... "
>>     
>
> I note that their figures (130k requests, 40k-50k fake replies per 
> request) suggest a minimum of 5.2e9 fake replies were sent.
>
> As I understand it, that's over twice as many requests as should *on 
> average* be needed to spoof a system with 32 bits of entropy (i.e. 2.0e9).
>   

I don't think so - 32 bits (unsigned) is 2^32, or roughly 4.3e9.

It might be that you are able to hit a 50% probability with half that.

But to guarantee 100%, you need to actually go > 100% of probability, 
since it is a moving target.

Basically, the numbers look right to me.

Brian