Subject: RE: What I mumbled at the mike today...

From: "Loomis, Rip" <[email-masked]>
Date: Mon, 9 Aug 2004 14:49:42 -0400

> > > speaking from the point of view of one trying to break in, it
> > > establishes a priori targets before entry is gained.  simply put,
> > > names that don't need to be exposed should not be exposed.
> > 
> > the people who agree with you and are serious about such, 
> > are already using split-view dns.  outsiders don't see things
> > that they shouldn't see.
> 
> Split DNS has absolutely no viability in a Web Services extranet
> application.

I think that you're still saying that zone enumeration is a
security issue and not a privacy issue.  Am I correct?

If you think that by not having a world-accessible DNS entry for a
network-connected system you significantly improve its security
posture, then I strongly disagree.  I've done penetration testing
for many years and I also monitor IDS devices.  The simple facts
today are that
  - If a system is connected to a network and it is vulnerable,
    then it will eventually be attacked.
  - The systems that are most likely to be attacked manually may
    be those most easily found in (DNS, Google, etc.) but the
    vast majority of attacks (both those being stopped and those
    successful) are automated.
  - If you have a system that is significantly appealing for
    someone to find it and target it specifically (for example
    by its name found in an enumerated zone file) then that
    system needs a very good set of safeguards and perhaps a
    name less appealing to attackers.

DNS data is only one of the inputs to the target selection
process for network-based attacks and it's a minor one.  I
don't expect that zone enumeration is going to suddenly
change that, based on personal experience.

I'm not saying that I want every outsider to have a perfect map
of the internals of an enterprise network--but spending a lot of
time preventing zone enumeration will also not keep bad guys from
mapping networks or provide a useful improvement in security
posture.  For my part, though, I do believe (as I have for
several years) that there are reasons why we should make a more
conscious choice about the trade-offs with allowing/preventing
zone enumeration (and I won't be sorry if we can eliminate it.)

I think that perhaps your statements about DNS in the context of
a "Web Services extranet application" need a little more explanation.
You say there's "no viability" but provide no hard data.

> If a significant constituency declares that an issue is a showstopper 
> then further discussion of the issue is pointless. 
Strongly disagree.  Declaring something as fact does not make
it fact.  Providing a real list of requirements each with a
basis would be more reasonable than saying "can't live with/without
it".  I'm one of the folks tasked to collect the requirements and
bases and I believe that there are "significant constituencies"
who have desirements that they would like to make requirements.

If there are conflicting requirements, though, then we will all
have a choice.  It sure would help if we made sure that we
all understood the real basis for each requirement--and when
different TLDs look at the same privacy laws and have interpretations
that are 179 degrees out of phase it makes things interesting.
That's assuming that we're looking at zone enumeration as a
privacy issue (which I think it is) and not a security issue
(which to me it is not.)

> 
> The DNS is nowhere near so pretty that it needs preservation as a 
> national treasure. 

Agreed.  Simultaneously, the DNS is already ugly enough that
continuing to add features and capabilities without considering
all the impacts may be hazardous.

  --Rip (still looking for more inputs on the requirements
    related to zone enumeration, NSEC, and DNSSEC in general, BTW)

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Edward Lewis <[email-masked]>
Date: Mon, 9 Aug 2004 15:48:21 -0400

>     related to zone enumeration, NSEC, and DNSSEC in general, BTW)

I'm at the same train station.  But I'll settle for reqt's on zone 
enumeration and NSEC. ;)

-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Edward Lewis                                            +1-703-227-9854
ARIN Research Engineer

"I can't go to Miami.  I'm expecting calls from telemarketers." -
Grandpa Simpson.