One must remember that the hackers use automated software that is primarily
fixed IP based.
I have several routable DHCP IP addresses that are not in DNS and each
firewall is scanned about the same way.
tedc
-----Original Message-----
From: fwbuilder-discussion-bounces@lists.sourceforge.net
[mailto:fwbuilder-discussion-bounces@lists.sourceforge.net] On Behalf Of Sam
Baskinger
Sent: Tuesday, June 13, 2006 8:16 AM
To: Nigel Stepp
Cc: Bob Radvanovsky; firewalls@securityfocus.com;
fwbuilder-discussion@lists.sourceforge.net; Ralph Forsythe; Bill Smith
Subject: Re: [Fwbuilder-discussion] Should FW have DNS name?
Steve Bellovin, Bill Cheswick, and Angelos Keromytis put together a
paper talking about how worms in IPv6 land would have several good
heuristics by which to find targets.
http://www.sagecertification.org/publications/login/2006-02/pdfs/bellovin.pd
f
I agree with Nigel if we constrain ourselves to IPv4, but hiding key
servers by not defining a DNS entry might be of greater gain when our
address space becomes more sparsely populated and quite intractable to
exhaustively scan.
Btw, just to be full about disclosure 'n such, Bill Cheswick works for
Lumeta Corporation as do I. Hope you like the paper! :)
Sam
Nigel Stepp wrote:
Ralph Forsythe wrote:
I think even something like 'goaway.domain.com' isn't necessarily good,
since in an effort to hide what it is, you've still told them it's
something they want to play with.
One must remember, however, that anyone looking to break into your
network will probably not be looking at hostnames a priori anyway.
Things will most likely start with a scan of an IP block, then
traceroute or similar will tell you what's up front.
As others have said, an A record for your firewall should be perfectly
safe. I even think a PTR record would do little to no harm.
You still have to make sure your firewall is secure, of course; but no
more than if you didn't have a name in DNS.
_______________________________________________
Fwbuilder-discussion mailing list
Fwbuilder-discussion@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/fwbuilder-discussion
