Subject: Re: dictionary attack on nameservers

From: [email-masked] (Ted Lindgreen)
Date: Tue, 17 Aug 2004 10:13:20 +0200

[Quoting David Blacka, on Aug 17,  8:14, in "Re: dictionary attac ..."]

> At some level, I see this argument as:
>   * group A says: we have this policy against zone enumeration.  We cannot 
> deploy DNSSECbis because of it.
>   * group B says: your policy is stupid, change it.
> 
> Either we need to convince group A that their policy is, in fact, stupid, or 
> we need to solve the problem.  Or just leave them behind.

I think your analysis is correct.

A small addition: when left behind, the group A-TLDs will later get
questions from their domainholders like "why can't we have secure
domainnames?".
I am interested whether their domainholders will understand and be
happy with an answer like "we can not deploy domainname security,
because the zonefile then gets enumerable".

> Just to press down a bit further: do you see no substantial difference between 
> being able to get 100% of a zone vs. getting perhaps 80% via datamining?  

My personal opinion (based on having been ISP from 1983 to 1999,
one of the founders of the current .nl registry, and still being
involved in DNS) is that there will be no substantial difference.
What we see is:

1. Spammers
   They are interested in e-mail addresses. Both the quality and quantity
   of acquired e-mail addresses from domainname-mining (i.e. hostmasters
   via whois, etc.) is low compared to other means of acquiring e-mail
   addresses in bulk.
2. Domainname traders
   They are not interested in a complete list, they are only interested in
   when an "interesting" domainname is released.. To know this as soon as
   possible (i.e. before their competition), they probe their list of
   names at short intervals (clearly visible in the nameserver traces).
   And we indeed see them register those released names immediately
   after being (negatively) probed. Fully automated...
3. Attackers, being script kiddy's and others. These gals and guys usually
   probe ranges of IP-adresses, not domainnames.

For the three threats above, enumerability or non-enumerability makes
no difference.

I am still quite interested in the threatmodel of group A above,
and the exact requirements to defeat those threats (including
their estimated effectiveness), because I am perhaps missing
something.

Regards,
-- ted

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: kent crispin <[email-masked]>
Date: Tue, 17 Aug 2004 23:14:32 -0700

[ Moderators note: Post was moderated, either because it was posted by a non-subscriber, or
   because it was over 20K.  
   With the massive amount of spam, it is easy to miss and therefore delete relevant posts 
   by non-subsrcibers. Please fix your subscription addresses. 
]

>    probe ranges of IP-adresses, not domainnames.

Whether script kiddies or organized crime, they probe ranges of IP
addresses *precisely* because ranges of IP addressess are trivially
enumerable.  If domain names become trivially enumerable, then they
will probe domain names, which will be more efficient than probing
ranges of IP addresses, plus giving out information that can't be
gleaned from probing IP addresses. 

Regards
Kent

-- 
[email-masked]    p: +1 310 823 9358  f: +1 310 823 8649
[email-masked] SIP: [email-masked]