[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: Trouble with Sender Authentication
On Nov 9, 2006, at 3:15 PM, william(at)elan.net wrote:
Doug, I don't have time for long discussion. But I'm telling you
that SPF has nothing to do with it and I can use either of "MX",
"SRV" or "NS" to generate similar amplification scenarios as you've
done with SPF using the same method.
Multiples of 100s of crafted DNS transactions directed toward a
victim by each message can not be compared against transactions
needed to obtain an MX, SRV, or NS resource record. The MX, SRV, or
NS resource records provide access to a service prompted by the
client and not an attacker. SPF scripts allow an attacker to
orchestrate hundreds of transactions at millions of recipients. The
gain of this exploit is large and essentially free for an attacker
also wanting to spam. For what other exploit would is be true?
In fact CSV (as far as I remember it) would cause highier amount of
amplification then SPF when bad guy controls domain put in EHLO and
decides to play special dns games with that name.
CSV specified that a single target be used. When associated with
DKIM per DOSP, an address literal or a single A record offers
sufficient validation. Validating the EHLO simply does not offer any
gain; nor is this gain is not multiplied by subsequent stages or
multiple recipients. SPF script transaction amplification is not
10:1 but more than 100:1. The gain executing SPF script is
multiplied by recipients and stages of delivery, such as MTAs and MUAs.
And in exactly the same way as you did it would generate 10:1 DNS
traffic amplification (SPF scenarios are basicly 10:1 amplification
after throwing away all the extras).
Some SPF scenarios are much larger than 10:1. SPF scripts can cause
havoc by additional 10 or 11 TXT wildcard resource record
transactions, but I'll leave that to your imagination. Any SPF
script exploit bypasses protections offered by DNS ACLs and BCP38. : (
-Doug