Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

1. The URL you provided doesn't mention any analysis of BIND.
2. You probably refer to a different, later article titled "DNS Cache Poisoning - The Next Generation", by LURHQ Threat Intelligence Group (http://www.lurhq.com/cachepoisoning.html).
3. You may have noticed that both papers are in fact referenced in my paper, as [8] and [9], respectively.
4. Also, the paper clearly outlines the novelty in the introduction section. The attractors method, as described in LURHQ's paper, requires sending 5000 forged responses, and is guaranteed to succeed only 20% of the time. In the new paper, a method is described in which by sending 1-10 responses, the attack is guaranteed to succeed (100%). All this of course given standard conditions. The paper also details why sending 5000 responses is way less feasible than sending 10 (ini terms of likelihood to get to the target server before the gebuine response does).

-Amit

On 24 Jul 2007 17:40:35 -0000, securityfocus@networkontap.com <securityfocus@networkontap.com> wrote:
> I don't exactly see how this is new "News" since Zalewski's paper on TCP sequence number analysis (which included analysis of versions of BIND):
>
> http://lcamtuf.coredump.cx/newtcp/
>
> -ntn
>
>
Received on Tue Jul 24 16:36:32 2007