<div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif">Nice work Brian and the CZ folks! <br></div><div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_default" style="font-family:tahoma,sans-serif">
Although you and me talked about this at CNS, but it was too stressed in time, so I have few questions:</div><div class="gmail_default" style="font-family:tahoma,sans-serif">1. Which resolvers (and versions) did you run the attack against?</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif">2. Which responses' type (and records) did you try to poison? e.g., referral, answer, NXDOMAIN, NODATA?</div><div class="gmail_default" style="font-family:tahoma,sans-serif">
3. Did you try spoofing the glue in responses to DNSSEC validating resolvers?</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif"><br></div><div class="gmail_extra"><div class="gmail_quote">On Wed, Oct 23, 2013 at 7:24 PM, Dickson, Brian <span dir="ltr"><<a href="mailto:bdickson@verisign.com" target="_blank">bdickson@verisign.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div style="font-size:14px;font-family:Calibri,sans-serif;word-wrap:break-word"><div>
<div>Paul Vixie wrote:</div>
<span>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div><br>
</div>
</blockquote>
<div>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div bgcolor="#FFFFFF" text="#000000">Haya Shulman wrote:
<blockquote type="cite">
<div dir="ltr"><br>
<div class="gmail_extra">
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
<div>> > so if i add "first weaponized by Haya Shulman" this would settle the<br>
> > matter?<br>
><br>
> Thank you, can you please use Amir Herzberg and Haya Shulman (I<br>
> collaborated on this attack together with my phd advisor Amir Herzberg).<br>
<br>
</div>
it shall be done.<br>
</blockquote>
<div><br>
</div>
<div style="font-family:tahoma,sans-serif">Thank you.</div>
</div>
</div>
</div>
</blockquote>
<br>
upon deeper consideration, "weaponized" is the wrong verb, unless you have released your software. i can say "first published" if that will serve your purpose.<br>
</div>
</blockquote>
</div>
</span>
<div><br>
</div>
</div><div>Sorry to join the discussion late.</div>
<div><br>
</div>
<div>FYI, I have been working on a proof-of-concept weaponized implementation of a fragmentation-based attack.</div>
<div>(My work is limited only to fragmentation, as I see that as the issue with the largest attack surface and which suffers from potential long-tail problems in mitigations.)</div>
<div><br>
</div>
<div>This work was inspired by Haya/Amir's work, although it did abstract things and go back to first principles on what to do and how to do it. The PoC code is a clean-room implementation.</div>
<div><br>
</div>
<div>I am also loosely collaborating with the CZ folks (Ondřej Surý et al) who are also doing their own independent PoC.</div>
<div><br>
</div>
<div>There was a presentation of this at the latest DNS-OARC meeting, as well as at the last RIPE meeting.</div>
<div><br>
</div>
<div>We will, of course, be keeping the code private, and will avoid releasing too many details.</div>
<div><br>
</div>
<div>When we have specific concrete results, we will share them in a responsible fashion.</div>
<div><br>
</div>
<div>Regardless of the specifics, the general result should be understood: the unsigned aspects of delegations, creates an exposure to poisoning which allows MitM, which facilitates a host of problems to anything which is not totally DNSSEC-signed and DNSSEC-validated.</div>
<span><font color="#888888">
<div><br>
</div>
<div>Brian Dickson</div>
</font></span><div><br>
</div>
<div>P.S. Credit for "weaponized" even if the code is shared with strict controls, rather than released, would be welcome, at the appropriate time.</div>
<span>
<div>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div bgcolor="#FFFFFF" text="#000000"><br></div></blockquote></div></span></div></blockquote><div> </div></div><div class="gmail_default" style="font-family:tahoma,sans-serif">Can you please refer me to a summary/report of your work? I will add reference to it in a journal version of our paper.</div>
<div class="gmail_default" style="font-family:tahoma,sans-serif">BTW, I am not sure you can release the code, IMHO you should check this with Peter Eckersley from the EFF (cc-ed).</div><br><br clear="all"><div><br></div>
-- <br><div dir="ltr">
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Best Regards,</span></font></p><p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Haya Shulman</span></font></p>
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Technische Universität Darmstadt</span></font></p><p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">FB Informatik/EC SPRIDE</span></font></p>
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Mornewegstr. 30</span></font></p><p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">64293 Darmstadt</span></font></p>
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px">Tel. <a href="tel:%2B49%206151%2016-75540" value="+4961511675540" target="_blank">+49 6151 16-75540</a></span></font></p>
<p style="margin:0cm 0cm 0.0001pt"><font color="#000000" face="Calibri, sans-serif"><span style="font-size:14.545454025268555px"><a href="http://www.ec-spride.de" target="_blank">www.ec-spride.de</a></span></font></p>
</div>
</div></div>