<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><br>On 26.10.2013, at 12:37, Haya Shulman <<a href="mailto:haya.shulman@gmail.com">haya.shulman@gmail.com</a>> wrote:</div><div><br></div><blockquote type="cite"><div dir="ltr"><div class="gmail_default" style="font-family:tahoma,sans-serif"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
This is essentially an IP packet modification vulnerability and in order<br> to do these, you don't even need fragmentation. This might happen even<br> due to malfunctioning network adapter or other network device, not<br>
necessarily an "attack". One of the reasons for DNSSEC existence is to<br> prevent processing of "damaged" DNS data, with malicious origin or not.<br>
If you are concerned with improperly assembled IP packets, the DNS<br> community is the wrong place to ask for a fix. The DNS community can<br> only make sure "their" protocol takes care of such issues, and issues<br>
like this are totally addressed by technologies such as DNSSEC, TSIG<br> etc. But the fundamental "fix" for this issue has to happen in the<br> TCP/IP stack.</blockquote></div><div class="gmail_extra"><div><br>
</div><div><br></div><div><div class="gmail_default" style="font-family:tahoma,sans-serif">IP does not, and was not designed to, guarantee security - only best effort end-to-end delivery. The discussion was if Eastlake cookies can prevent the attacks: the example I showed was a legitimate way to apply IP fragmentation (which is a feature of IP - it is not a bug) to foil the protection offered by Eastlate cookies and to inject spoofed content into the DNS response (despite the use of Eastlake cookies for protection). This should be of interest to DNS community, unless you argue that the DNS community should rely on IP layer for security of DNS.</div>
</div><div><br></div></div></div></blockquote><br><div>There is a technology, designed to handle this and other "problems" of DNS - well known as DNSSEC.</div><div><br></div><div>Many here, including me argue that instead of applying medicine that "cures" the symptoms, we cure the disease instead.</div><div><br></div><div>But, just like with the human medicine, there are apparently agendas that suggest keeping these symptomatic threat mento.</div><div><br></div><div>Daniel</div></body></html>