[dns-operations] first (lab) spoof of a fully source port randomised server reported
briand at ca.afilias.info
Fri Aug 8 19:12:03 UTC 2008
Ray.Bellis at nominet.org.uk wrote:
>> "Attack took about half of the day, i.e. a bit less than 10 hours.
>> So, if you have a GigE lan, any trojaned machine can poison your DNS
>> one night... "
> I note that their figures (130k requests, 40k-50k fake replies per
> request) suggest a minimum of 5.2e9 fake replies were sent.
> As I understand it, that's over twice as many requests as should *on
> average* be needed to spoof a system with 32 bits of entropy (i.e. 2.0e9).
I don't think so - 32 bits (unsigned) is 2^32, or roughly 4.3e9.
It might be that you are able to hit a 50% probability with half that.
But to guarantee 100%, you need to actually go > 100% of probability,
since it is a moving target.
Basically, the numbers look right to me.
More information about the dns-operations