North American Network Operators Group|
Date Prev | Date Next |
Date Index |
Thread Index |
Author Index |
Re: DNS cache poisoning attacks -- are they real?
- From: John Payne
- Date: Mon Mar 28 01:05:24 2005
On Mar 27, 2005, at 1:25 PM, Christopher L. Morrow wrote:
Hrm? Larger providers tend to have old swamp space lying around :)
Larger providers have the problem that you can't easily filter
'customers' from 'non-customers' in a sane and scalable fashion.
Throw the resolvers on a netblock that's not routed out to your border
routers (transit, peering), only the customer facing ones... with a
secondary address that is routed. Secondary address doesn't listen for
queries, only answers.
And to Randy's point about problems with open recursive nameservers...
abusers have been known to cache "hijack". Register a domain,
configure an authority with very large TTLs, seed it onto known open
recursive nameservers, update domain record to point to the open
recursive servers rather than their own. Wammo, "bullet proof" dns
(Yeah, it'd be nice if people didn't listen to non-AA answers to their
queries, but they do).