Subject: Re: dictionary attack on nameservers

From: [email-masked] (Ted Lindgreen)
Date: Thu, 29 Jul 2004 13:58:10 +0200

[Quoting Jay Daley, on Jul 29, 12:40, in "Re: dictionary attac ..."]

> > I know of a number of registrars who keep daily updated, and
> > very accurate lists of registrered and returned domain names.
> > For .nl and also for other TLDs.
> > 
> > These guys use various techniques to keep their lists accurate
> > and up-to-date. Although highly effective, these techniques are
> > neither complicated, nor costly for the registrar.
> > However, their load the .nl nameservers is significant, and thus
> > one can easily see and determime who/what is causing it in the
> > nameserver-traces which we routinely investigate in our testlab.
> 
> With respect this is still anecdotal.  Where is the real data?  i.e. "By 
> dictionary attack X managed to guess Y% of the 1.3m names".

Dear Jay,

Thank you for calling our work "anecdotal".

You dispute the existance of cybersquatters, spammers, etc. using
fairly accurate lists of existing domainnames.  You even dispute
the possibility of those techniques, and want us to come up with a
full quantitative analysis of one such technique.

However, NLnet Labs is not founded (nor funded) to prove the obvious,
and therefore we will not waste more time this than we have done
already.

For us it suffices, that:
1. with very little work we could do a dictionary attack on .nl,
   revieling the number of domainnames we expected (feared);
2. from work with/at the .nl registry and registrars we know that
   a number of registrars maintain accurate and uptodate lists of
   many TLDs, despite that most of these TLDs have closed AXFR
   many years ago;
3. from work in our testlab with traces of .nl nameservers we have
   seen how some of those registrars obtain part of the info in 2;
4. from other postings in this thread it is clear that others have
   seen various other methods to obtain good lists of registered
   domainnames in the current DNS even when AXFR is blocked.

If you can prove, or at least provide reasonable evidence, that in
a world where above already takes place, NSEC2/3/X versus NSEC makes
enough of a difference to necessitate a redo of the protocol, please
do so.
Sofar, I've only heard about "some privacy-laywer's opinion", vague
"new possibilities" that perfect against 99% accuraty could allow for
(ghost-hunting), and thirdly, fear that nameservers could suffer
overload from NSEC walking (which is provably incorrect: the current
attack-techniques impose already a much greater load, plus that just
making the zone file available via ftp is even more effective).

Please explain to us why NSEC2/3/X is REALLY needed, instead of
asking us to prove the obvious.

-- ted

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Alex Bligh <[email-masked]>
Date: Thu, 29 Jul 2004 13:42:34 +0100

> asking us to prove the obvious.

Sorry, unless I'm dropping mail message you have not shown that over x% of
the zone file can be obtained through dictionary attacks in a small amount
of time, where x is a large number (let's say 90% or 95%). Mark Gieben
acknowledged this in the post where he said "Statistics==Lies".

You have merely shown where x is a small number, it can be obtained, and
extrapolated. For the reasons posted on this list, and which indeed should
be obvious, if you can find (say) 25% if (say) 10 hours, that by no means
suggest you can find 90% in less than 40 hours.

The reasons for the requirement for non-traversal of zones (NSEC2/NSEC3)
have been expounded at great length; I don't see any purpose in repeating
them again. As far as I can tell, the w/g reached consensus that there was
a requirement (perhaps not one you have) but that it would not form part of
DNSSECbis.

You have neither demonstrated that that requirement has gone away (as even
if you could demonstrate the .NL zone file can be recovered 100% accurately
by dictionary attack in a small amount of time, that does not necessarily
extinguish a requirement elsewhere - see comment on .com), nor have you
demonstrated that your original thesis (that nearly all of the zone
contents could be retrieved by dictionary attack) is true.

If it's true that you don't have the resources or appetite to perform your
statistical test, can I suggest you post your perl programs and methodology
in detail, and let someone else demonstrate whether or not a dictionary
attack can actually reveal let's say over 95% of a zone file, and the
number of queries it took.

The whole thesis of those proposing NSEC2/3 has been that DNSSEC should not
make the situation substantially WORSE. If it is the case that existing
attacks are just as easy to perform by the attacker as NSEC enumeration,
then that would have some weight. We already know dictionary attacks cannot
in the general case yield a complete zone. Your suggestion that they can
yield a nearly complete zone (for values of nearly like 95%) for effort
comparable with an NSEC enumeration is at the moment not supported by any
data I have yet seen - if it is incorrect, it's probably also disprovable.

If you are going to claim you have a new argument based on new data, please
supply that data, not go half way then claim you are neither "founded
or funded" to produce the relevant results.

Alex