1. DNS/FCP

DNSSECだけに目を向けているのでは危ない。 /JPRS

1.1. Fragmentation Considered Poisonous

Contents

DNS/FCP

Fragmentation Considered Poisonous: Amir Herzberg and Haya Shulman を検討する。/考察

-- ToshinoriMaeno 2018-11-20 23:46:05

https://u.cs.biu.ac.il/~herzbea/security/13-03-frag.pdf

https://ieeexplore.ieee.org/document/6682711

FreeBSD : /net.inet.ip.random_id

Arnir Herzber,Haya Shulman: 2013 IEEE Conference on Communications and Network Security (CNS) Fragmentation Considered Poisonous, or: one-domain-to-rule-them-all\.org

https://www.researchgate.net/profile/Amir_Herzberg/publication/253954678_Fragmentation_Considered_Poisonous_or_One-domain-to-rule-them-allorg/links/56b1b53808aed7ba3feb7782/Fragmentation-Considered-Poisonous-or-One-domain-to-rule-them-allorg.pdf …

The maximum safe UDP payload is 508 bytes. /UDPpayload

https://stackoverflow.com/questions/1098897/what-is-the-largest-safe-udp-packet-size-on-the-internet

「第一フラグメント便乗攻撃」という呼び方は攻撃手法の一部しか示していない。重要なのは返答パケットを分割送信させる部分だろうと思う。分割させられれば、偽返答とすり替えることは簡単だから。

(防御としては、分割されたパケットは捨てるのが有効だ。) 13:30 - 2019年2月25日

第一フラグメント便乗攻撃(アイコラ攻撃)こやね (@xkoyane) http://www.convivial.ne.jp/dns/extra2019/aikora.pdf

部分差し替えができただけでは十分ではない。よくまとまっているスライドだ。

1.2. なぜ

2018年になって、偽サーバー証明書が取得できたという発表があった。(/Brandt_abstract 公開)

https://dl.acm.org/citation.cfm?id=3243790 /haya-abstract
https://ieeexplore.ieee.org/document/8416351

原論文(2013) 見直しにより、脆弱な実装が複数あることが指摘された。(tss_ontap)

Unboundは修正ずみ、PowerDNS recursorは次の版で対応する。

1.3. 手がかり

https://twitter.com/OrangeMorishita/status/1039451291934646274

PowerDNS Blog September 10, 2018 Spoofing DNS with fragments

https://blog.powerdns.com/2018/09/10/spoofing-dns-with-fragments/

https://www.theregister.co.uk/2018/09/06/certificate_authority_dns_validation/
https://ds9a.nl/tmp/powerdns-xs4all-presentatie.pdf

https://lists.dns-oarc.net/pipermail/dns-operations/2018-September/017959.html

https://lists.dns-oarc.net/pipermail/dns-operations/2018-September/017950.html

it being communicated clearly and widely as early as 2008

/Let's_Encrypt の対応もあった。

/Path_MTU_Discovery /IPv4　/フラグメント処理　 /kresd

https://www.slideshare.net/MenandMice/dns-fragmentationattacks-slides

フラグメント・ストーム警報： https://twitter.com/takasugi_mbsjk/status/1064349010041815040

https://twitter.com/takasugi_mbsjk/status/1064202022197424132

DNS message fragments draft-muks-dns-message-fragments-00 https://tools.ietf.org/id/draft-muks-dns-message-fragments-00.html

1.4. 2013

/毒の例　 /Let's_Encrypt dns-operations /2013

dns-operations ML: /haya

https://lists.dns-oarc.net/pipermail/dns-operations/2013-September/010681.html

DNSSEC mistake:

In retrospect, not signing delegations and glue was a huge mistake.

https://lists.dns-oarc.net/pipermail/dns-operations/2013-September/010678.html

Fragmentation Considered Poisonous: Amir Herzberg and Haya Shulman

https://arxiv.org/pdf/1205.4011.pdf /abstract (Submitted on 17 May 2012)

https://www.ietf.org/proceedings/87/slides/slides-87-saag-3.pdf

https://tools.ietf.org/id/draft-muks-dns-message-fragments-00.xml

DNSSEC, the time has come! https://www.ietf.org/proceedings/87/slides/slides-87-saag-3.pdf

関連： IP Fragmentation Considered Fragile　　R. Bonica https://tools.ietf.org/id/draft-ietf-intarea-frag-fragile-00.html https://tools.ietf.org/id/draft-ietf-intarea-frag-fragile-02.xml

J. Heffner IPv4 Reassembly Errors at High Data Rates July 2007 https://tools.ietf.org/html/rfc4963

/mueller

1.5. [dns-operations]

/2018 にも。

DNS Attack over UDP fragmentation

Ondřej Surý ondrej.sury at nic.cz Wed Sep 4 13:08:55 UTC 2013 https://lists.dns-oarc.net/pipermail/dns-operations/2013-September/010627.html

Haya Shulman haya.shulman at gmail.com Fri Sep 6 01:02:59 UTC 2013 https://lists.dns-oarc.net/pipermail/dns-operations/2013-September/010681.html

Aaron Campbell July 2007 https://lists.dns-oarc.net/pipermail/dns-operations/2013-September/010679.html

http://www.hpl.hp.com/techreports/Compaq-DEC/WRL-87-3.pdf

Fragmentation Considered Harmful
Christopher A. Kent
Jeffrey C. Mogul
December, 1987

d i g i t a l Western Research Laboratory /長大返答　　 /BIND　/root-dnskey /edns_size

https://lists.dns-oarc.net/pipermail/dns-operations/2013-September/010719.html On Tue, Sep 10, 2013 at 07:14:04PM +0300,

Haya Shulman <haya.shulman at gmail.com> wrote a message of 187 lines which said:

> > the trouble with randomizing the IPID is that this would require
> > kernel-level patches (as opposed to just DNS server software
> > upgrade), I believe.  This makes it somewhat harder to deploy.

https://lists.dns-oarc.net/pipermail/dns-operations/2013-September/010659.html