Comments on Jon Hart's Blog: Mitigating DNS cache poisoning with PF

Tommy,Since you didn't leave an email, I have to d...

2008-11-05T22:06:00.000-08:00

Tommy,

Since you didn't leave an email, I have to do this publicly. No, I can't help you here. Email me and thats a different story.

-jon

I'm just giving this a random shot.I am looking to...

2008-11-05T16:40:00.000-08:00

I'm just giving this a random shot.

I am looking to find information on Sagwatch.net

It is an anonymous, privately registered blog that posts smack about the Screen Actors Guild.

I am trying to find any information I can regarding the registrar, the geographical location of the blog, etc.

If you can't help me, can you point me in the right direction?

Thanks!

Tommy Landreu

If the DNS server is running on the OpenBSD box or...

2008-08-12T10:44:00.000-07:00

If the DNS server is running on the OpenBSD box or not you should be able to increase the source port randomization with NAT. By
default NAT using Pf will use source ports 49152 to 65535. This will show a ~4900 port standard deviation using kaminsky's tool. You can increase the source port pool by adding "port 1024:65535" to the end of your NAT line in pf.conf. This will easily increase the standard deviation to over 20K. If it helps we have a full explanation and example at Calomel.org https://calomel.org/pf_config.html

How can others help your suit? Comcast is not a go...

2008-07-30T09:55:00.000-07:00

How can others help your suit?
Comcast is not a good company. They break a lot of rules, and do not play fair. Just look at their previous owners "Adelphia."

Let us know how others can help.

mr

"If I am mistaken in any of my assumptions or sugg...

2008-07-27T18:01:00.000-07:00

"If I am mistaken in any of my assumptions or suggestions, I would love to hear differently."

Let's play with that.

'I would love to hear differently, If I am mistaken in any of my assumptions or suggestions'

So, if you are mistaken, you would like to hear otherwise? :]

/pedant

@Dan Kaminsky:The results look good. Previously, ...

2008-07-26T20:08:00.000-07:00

@Dan Kaminsky:

The results look good. Previously, the DNS-OARC tests were showing me as good whereas yours was not. Now it seems to correctly detect my mitigation steps:

bf0d8ea5035e.doxdns5.com:
208.127.144.14:61831 TXID=4821
208.127.144.17:52716 TXID=11826
208.127.144.19:59798 TXID=27644
208.127.144.20:53650 TXID=3141
208.127.144.15:56428 TXID=18012

@Anonymous: This should work in either situation ...

2008-07-26T20:07:00.000-07:00

@Anonymous:

This should work in either situation -- when the DNS server is on the same box as pf, or when the DNS server is "behind" pf. You will obviously need to modify your interfaces and addresses to match your setup, however the URl that Steve provided just prior to your comment has a more robust solution with regards to interfaces names and such.

Jon, Thanks for the good words. Can you test no...

2008-07-26T19:25:00.000-07:00

Jon,

Thanks for the good words. Can you test now on the script presently hosted at www.doxpara.com? It should correctly detect randomness from you.

This doesn't work when the DNS-server is on the pf...

2008-07-22T03:46:00.000-07:00

This doesn't work when the DNS-server is on the pf box itself, right?

Doesn't seem to work for me.

Stuart Henderson helpfully posted this suggestion ...

2008-07-20T16:33:00.000-07:00

Stuart Henderson helpfully posted this suggestion to misc@ the day after the DNS vuln was announced. Anyone reading misc should already be covered.

http://marc.info/?l=openbsd-misc&m=121561002720622&w=2

Michael Rash over at Cipherdyne has written a simi...

2008-07-16T10:05:00.000-07:00

Michael Rash over at Cipherdyne has written a similar article that talks about mitigating this vulnerability using Linux's iptables.