5 ms·

In terms of a long-term solution to the DNS cache poisoning issue it seems deep packet inspection could be the only way to go. The work-around was to extend the

by Allocator2008 17y ago

In terms of a long-term solution to the DNS cache poisoning issue it seems deep packet inspection could be the only way to go. The work-around was to extend the encryption involved with DNS but that only makes it harder, but not impossible for DNS hacks to take place. Only if deep packet inspection happens would DNS hacks truly become a thing of the past, since if my ISP is inspecting all the packets, and it's stored IP for say cnn.com gets re-routed to a hacker's IP, an inspection of the packets coming across could flag a problem to the ISP. I am not an expert in this area but I just recall from reading a 'Wired' article on this issue that the only really good solution here is in fact deep packet inspection. So outlawing it would be a hacker's wet dream, and by hacker I mean "cracker" or "black hat" people obviously.

iguqe7098a 17y ago
This is completely nonsense. The current workaround to the DNS spoofing hacks has nothing to do with encryption. The solution to DNS spoofing has nothing to do with packet inspection (Google for DNSSEC and DNSCurve for details).
tptacek 17y ago
(1) No part of the DNS is currently any hacker's wet dream. Why bother spoofing at all? You don't need to bust out the batmobile to get into most people's accounts. (2) The technique that "extended" DNS' security is the same technique that protects plenty of other core Internet protocols, so if it doesn't work at least in the medium term, we're all doomed. (3) The issue isn't whether DNS is breakable --- it always has been --- it' s how easy it is. The problem is about cost, not about raw capability. If you can't pull the attack off drive-by, it doesn't make a difference in 2009. (4) Anybody who tries to sell you on a DPI solution to DNS security is scamming you. You'd need a globally deployed network of DPI boxes, all synchronized, to make a dent in the problem.

iguqe7098a 17y ago

This is completely nonsense. The current workaround to the DNS spoofing hacks has nothing to do with encryption. The solution to DNS spoofing has nothing to do with packet inspection (Google for DNSSEC and DNSCurve for details).

tptacek 17y ago

(1) No part of the DNS is currently any hacker's wet dream. Why bother spoofing at all? You don't need to bust out the batmobile to get into most people's accounts. (2) The technique that "extended" DNS' security is the same technique that protects plenty of other core Internet protocols, so if it doesn't work at least in the medium term, we're all doomed. (3) The issue isn't whether DNS is breakable --- it always has been --- it' s how easy it is. The problem is about cost, not about raw capability. If you can't pull the attack off drive-by, it doesn't make a difference in 2009. (4) Anybody who tries to sell you on a DPI solution to DNS security is scamming you. You'd need a globally deployed network of DPI boxes, all synchronized, to make a dent in the problem.