Re: "BIND 9 DNS Cache Poisoning" by Amit Klein (Trusteer)

1. The URL you provided doesn't mention any analysis of BIND.

2. You probably refer to a different, later article titled "DNS Cache
Poisoning - The Next Generation", by LURHQ Threat Intelligence Group
(http://www.lurhq.com/cachepoisoning.html).

3. You may have noticed that both papers are in fact referenced in my
paper, as [8] and [9], respectively.

4. Also, the paper clearly outlines the novelty in the introduction
section. The attractors method, as described in LURHQ's paper,
requires sending 5000 forged responses, and is guaranteed to succeed
only 20% of the time. In the new paper, a method is described in which
by sending 1-10 responses, the attack is guaranteed to succeed (100%).
All this of course given standard conditions. The paper also details
why sending 5000 responses is way less feasible than sending 10 (ini
terms of likelihood to get to the target server before the gebuine
response does).

-Amit

On 24 Jul 2007 17:40:35 -0000, securityfocus@networkontap.com
<securityfocus@networkontap.com> wrote:
> I don't exactly see how this is new "News" since Zalewski's paper on TCP 
> sequence number analysis (which included analysis of versions of BIND):
>
> http://lcamtuf.coredump.cx/newtcp/
>
> -ntn