Exploit for DNS Cache Poisoning - RELEASED
mike at rockynet.com
Wed Jul 23 17:58:43 CDT 2008
Joe Greco wrote:
> So, I have to assume that I'm missing some unusual aspect to this attack.
> I guess I'm getting older, and that's not too shocking. Anybody see it?
AFAIK, the main novelty is the ease with which bogus NS records can be
inserted. It may be hard to get a specific A record
(www.victimsbank.com) cached, but if you can shim in the NS records of
your ns.poisoner.com authority, then getting the real target A record is
trivial since you'll be asked directly for it (and can wait for the
legit clients to ask for it for you).
More information about the NANOG