News for hackers. Stuff that matters.

A comment on DNS cache poisoning, the Internet attack from 2008, is back from the dead. Parent comment

Re:DNS cache poisoning, the Internet attack from 2008, is ba... by LinuxBender on Thursday November 12, 2020 @11:35AM (#25071575)
Does that mitigate this scenario? In many cases, clients may be talking directly to 1.1.1.1, not servers. At least that is a pattern I have seen people using. Only servers validate DNSSEC. So people using Unbound DNS at home or in their corporate network may be protected from this, but I am not aware of any local OS resolvers that validate DNSSEC. You are right though, people should certainly be using DNSSEC on all their zones.
[ Parent | on HN ]
Re:DNS cache poisoning, the Internet attack from 2008, is ba... by alwillis on Thursday November 12, 2020 @12:24PM (#25072101)
You can use Unbound as your local resolver pretty easily.

I run it on an old laptop running FreeBSD and have my other machines use it as their DNS server.

[ Parent | on HN ]
Re:DNS cache poisoning, the Internet attack from 2008, is ba... by LinuxBender on Thursday November 12, 2020 @12:28PM (#25072154)
Absolutely. I do this as well on a couple laptops so I get the same anti-adware my home network has. I've even managed to get a couple other people to try it out.
[ Parent | on HN ]
Re:DNS cache poisoning, the Internet attack from 2008, is ba... by tptacek on Thursday November 12, 2020 @12:35PM (#25072262)
That solves that one DNSSEC problem for you, but no mainstream operating system deploys a local DNSSEC-validating recursive cache, and something like half of all Internet usage comes from mobile/tablet devices where you can't do that at all. Realistically, to a first approximation, nobody is going to do this.
[ Parent | on HN ]