Hacker News Reader

"I was lucky to collaborate on DNS issues with Dan when he discovered a new form of DNS cache poisoning"

A really good, and really detailed, overview of what Kaminsky found: http://www.unixwiz.net/techtips/iguide-kaminsky-dns-vuln.htm... Kaminsky references this from the sidebar in his blog.

View on HN

Wait, they only made this attack 2000 times harder? That was the whole fix?

Additional mitigations started to come in to play after that to make it both impractical, detectable, and improbable. It's just shy of impossible now, and in the very unusual scenarios where it's possible, it's so easily detectable.

Dan's work pushed the adoption of BCP38, segmentation of authoritative and recursive resolvers, and better source port randomization. Entirely new mitigations were developed like 0x20, source address randomization, and double response detection.

Reply on news.ycombinator.com