DNS cache poisoning, the Internet attack from 2008, is back from the dead

Re:DNS cache poisoning, the Internet attack from 2008, is ba... by toast0 on Thursday November 12, 2020 @01:34PM (#25073065)

For #2; I would think you could reasonably disable sending ICMP port unreachable (possibly for UDP only) for these machines. Or at least for the IPs they use for sending queries.

It's not strictly required, and leaks information. I don't know what an dns server would do with an icmp unreachable to its reply anyway.

Random drop would work too of course. I think there's a general concern about these rate limits leaking information, but it's hard to address because of many concerns. Alternatively a big push to use lots of IPv6 addresses would increase the search space and make it harder to spoof (contingent on IPv6 support in authoritative and recursive severs and their networks)

[ Parent | on HN ]

Re:DNS cache poisoning, the Internet attack from 2008, is ba... by tptacek on Thursday November 12, 2020 @01:41PM (#25073167)

I had the same first impression, and it's not like ICMP unreachables weren't already a security issue (they're how you do UDP port scans in the first place). I assume there's a reason they're kept enabled. But you could keep them enabled and approximately 100% functional while breaking this attack just by dropping a couple now and then.

[ Parent | on HN ]