Slashdot Log In
Dan Kaminsky Suggests Having Fun with DNS
Posted by
timothy
on Mon Jun 21, 2004 05:38 PM
from the bits-is dept.
from the bits-is dept.
boogahsmalls writes "A few weekends ago Dan Kaminsky of scanrand fame presented some pretty cool ideas involving DNS that made plenty of heads spin at the LayerOne Technology Conference. Some of his concepts included Voice over DNS and storing Knoppix in a DNS cache. He's also apparently got a couple new tools in the pipe including a scanrand based DNS scanner and a visualization suite. Could another version of Paketto Keiretsu be in the works?" (OpenOffice.org does a great job of opening the PowerPoint slideshow.)
This discussion has been archived.
No new comments can be posted.
Dan Kaminsky Suggests Having Fun with DNS
|
Log In/Create an Account
| Top
| 212 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
No thanks, (Score:5, Insightful)
Nice ideas (Score:5, Funny)
use the DNS to store presentations (Score:4, Funny)
RTFPP? (Score:4, Funny)
(http://left-wing.org/ | Last Journal: Tuesday December 27 2005, @03:44PM)
Great Article (Score:5, Insightful)
Mark this as flamebait if you will, but come back in a while and read the comments, I promise there will be hardly any discussion of the paper.
Dan is obviously a very smart guy, I like his ideas about using http tunnel (it's a great program), I'm going to have to give some of these ideas a work out!
Bob
Re:Great Article (Score:5, Insightful)
Slides 1-10 of 44, and /.'s lameness filter sucks (Score:4, Informative)
(http://burningwell.org/)
This paragraph is random crap to keep TFLSLF happy, please ignore it. Getting this past TFLSLF was five times harder than copy-pasting the individual text elements. This paragraph is random crap to keep TFLSLF happy, please ignore it. Getting this past TFLSLF was five times harder than copy-pasting the individual text elements. This paragraph is random crap to keep TFLSLF happy, please ignore it. Getting this past TFLSLF was five times harder than copy-pasting the individual text elements. This paragraph is random crap to keep TFLSLF happy, please ignore it. Getting this past TFLSLF was five times harder than copy-pasting the individual text elements. This paragraph is random crap to keep TFLSLF happy, please ignore it. Getting this past TFLSLF was five times harder than copy-pasting the individual text elements. This paragraph is random crap to keep TFLSLF happy, please ignore it. Getting this past TFLSLF was five times harder than copy-pasting the individual text elements. This paragraph is random crap to keep TFLSLF happy, please ignore it. Getting this past TFLSLF was five times harder than copy-pasting the individual text elements.
Black Ops 2004 @ LayerOne
Dan Kaminsky
Introduction
What's On The Plate for Today?
/* char descrip[256] = "You'll see"; */
What is DNS
"Useful" Traits of DNS
(Very Very Abridged)
Re:Great Article (Score:5, Interesting)
(Last Journal: Tuesday June 22 2004, @04:22PM)
His techniques allow someone to set up a cryptographically secure network that most likely completely ignores firewalls. It features high bandwidth-high latency connection, low bandwidth-low latency connections and is virtually untraceable, even to both parties involved in the connection. An initial hostname and time would act as the 'phonenumber'. (By keeping a certain request alive, one can even implement a dailing service with TTL delay.) A message service is freely included.
It is virtually impossible to shut these networks down without replacing/patching dns. Not an easy task.
The bandwidth available to this network most likely exceeds that of most irc-botnets. Especially since the root servers are defending themselves against DDoS attacks.
The tools he's still developing might be able to trace these things but it will still require cooperation of dns server administrators (to get their logs). You will never get them all and you'll have a LOT data to process. Accorfing to this [internetnews.com] the ICS root server continuosly handles almost 8Mbps (and can handle upto 80Mbps) of traffic. I seriously doubt they can log that... (if so, transferring the logs would continually consume a healthy percent of the servers bandwidth.)
Pretty smart man indeed and very idealistic or shortsighted. Both the right and the wrong sort of people would pay a lot of money for that...
Re:Great Article (Score:5, Informative)
Search Service (Score:5, Funny)
(Last Journal: Saturday November 30 2002, @01:53AM)
Another pointless piece of information: (Score:5, Funny)
Re:Another pointless piece of information: (Score:5, Funny)
(http://www.chriscanfield.net/)
1: Funny retort about clippy, modded +5 insightful
2: Serious post defending Power Point, modded -1 Flamebait
3: Humorous post about necessary height of a post to go over one's head, modded +2 interesting
4: Serious post questioning the connection between wooden posts and the stability of Microsoft Software, modded +2 Funny
Meta comment about the rediculousness of it all: Priceless.
Re:Another pointless piece of information: (Score:4, Funny)
(http://www.manu.com.au/)
A Slashdotter who can't spell "ridiculous": inevitable.
Crazy! (Score:5, Insightful)
(http://www.howtobeinvisible.com/ | Last Journal: Thursday October 04, @07:42AM)
I could swear BIND and its config file is considered, along with Sendmail, one of the most convoluted programs in Internetdom. It, again along with Sendmail, is historically also one of the most bug-ridden and exploited.
And now someone is suggesting futzing around with it?! Why not just change your domain to "rootmeplease.com" and get it over with?
-Charles
Re:Crazy! (Score:4, Informative)
Re:Put up or shut up. (Score:4, Interesting)
(http://www.crfh.net/ | Last Journal: Tuesday November 14 2006, @02:47PM)
The djbdns security guarantee
I offer $500 to the first person to publicly report a verifiable security hole in the latest version of djbdns.
Examples of problems that do not qualify:
* Denial-of-service attacks. (BIND 9's fragility makes denial of service completely trivial; but an attacker can easily take down the Domain Name System without using any of BIND's bugs. The DNS architecture needs to be decentralized.)
Says it right there. It's a DoS attack that, by means of a series of specially-selected queries, forces worst-case behavior out of the caching algorithm.
Re:Crazy! (Score:5, Funny)
Q: What is the difference between a sendmail.conf file and modem noise
A:
Nasty Nasty HTML Version (Score:5, Informative)
(Last Journal: Thursday February 15 2007, @08:00PM)
Note: Was converted with *gasp*powerpoint so yes it is horrible
Heh (Score:1, Redundant)
(http://put-your-mone...r-mouth-is.com/blog/ | Last Journal: Monday January 29 2007, @02:44PM)
Paketto Keiretsu (Score:2)
Silly poster, the article's link to Dan's website brings you to the new tools (in "prebuild three"). Can someone please get a
Those are some seriously amazing gadgets in there, but I have to say I've yet to actually, you know, use one in any particular way.... yet I'm excited there are more out! I somehow want to know I could store knoppix in DNS even if I'm not likely to actually do it.
He has an excellent conclusion (Score:2)
(Last Journal: Thursday February 15 2007, @08:00PM)
Stuff = Cool
More Stuff Soon
This guy is amazing! Where does he come up with this stuff!
SPF and SPF+ work over DNS (Score:4, Informative)
The open source community's response so far has been SPF+ [listbox.com], which is essentially a technique of encoding the rules in TCL, which is served over DNS and executed on the mailserver. For obvious reasons, SPF+ will probably define the future of spam control on the internet.
Parent is a troll linking to a troll (Score:5, Informative)
Some of this stuff really makes alot of sense (Score:4, Interesting)
(http://www.lookuplaws.com/ | Last Journal: Sunday November 18, @06:33PM)
This guy proposes putting content (eg Knoppix) into DNS.
Why is DNS particularly not well suited for this kind of distribution mechanism?
Seems to me that if the RIAA wanted to distribute their movies via broadband providers (an inevitability, I'm afraid) the biggest problem would be dealing with BANDWIDTH.
I always figured that ISPs would have to have some way to cache content locally so their Internet pipes don't get absolutely HAMMERED by all the people viewing the latest flick...
DNS already has a mature, stable, and lightweight caching mechanism in place. Why not use it?
Honestly, caching content a la DNS might provide a MUCH more efficient content distribution mechanism than, say, BitTorrent.
Where's the bad part of this idea?
Re:Some of this stuff really makes alot of sense (Score:4, Interesting)
Further, DNS would need to be upgraded. There is a good reason that short-term, experimental applications are better done at the ends; read the End-to-end arguments in system design [reed.com] for further insights.
Re:Some of this stuff really makes alot of sense (Score:5, Informative)
(http://slashdot.org/)
1) I think the requirement for caching sets of 4 byte IP addresses and 4 GB movies are quite different. Just because a system is good at one, doesn't mean it will automatically be good at the other. When I RTFA, the author made it quite clear that there was a 512-byte packet size limit, of which only around 50% could be useful for actual data. By the author's own estimation, it would take 35,000 DNS servers to host a single 700mb Knoppix image.
2) DNS is already an overloaded system, and his idea uses recursion, so it would place even more load on top of it.
If you think this is going to replace BitTorrent, you're off your rocker.
Re:Some of this stuff really makes alot of sense (Score:5, Interesting)
(http://www.stormcenter.net/ | Last Journal: Friday January 16 2004, @11:14PM)
Were that we could...
Why is DNS particularly not well suited for this kind of distribution mechanism?
Because DNS is designed to handle its hierarchical data, not massive amounts of content? The extra fields available in DNS are there fo, well, DNS related stuff.
Seems to me that if the RIAA wanted to distribute their movies via broadband providers (an inevitability, I'm afraid) the biggest problem would be dealing with BANDWIDTH.
I know you meant the MPAA, not the RIAA, but I think their biggest problem will be letting go of their deep seated need for control, rather than bandwidth. They can afford the pipe. And I, for one, would be incredibly pissed off to find the RIAA (or any other commercial service) caching their stuff on MY name server.
I always figured that ISPs would have to have some way to cache content locally so their Internet pipes don't get absolutely HAMMERED by all the people viewing the latest flick...
Like, say, USENET?
DNS already has a mature, stable, and lightweight caching mechanism in place. Why not use it?
We do. Millions of times a day. We use it every time we translate a name to an IP number. Looking up, say www.slashdot.org
Honestly, caching content a la DNS might provide a MUCH more efficient content distribution mechanism than, say, BitTorrent.
Highly unlikely. A highly effecient system dedicated to caching content will almost certainly be better than trying to do the same thing with DNS. It's simply not made for it.
Where's the bad part of this idea?
Inefficiency. Load on already stressed servers. Better existing solutions. Should I go on?
Dan's come up with some brilliant ideas over time. Definately A Geek's Geek. But this one sounds a lot more like one of his thought experiments than an actual proposal. Like directly burning CD's over an SSH tunnel...
Re:Some of this stuff really makes alot of sense (Score:5, Insightful)
(http://www.doxpara.com/)
There's millions of servers out there that we can interface with -- what's the impact of that? If nothing else, it's fun to be playing with something other than TCP headers
--Dan
P.S. A broom can be used to sweep the floor -- or to knock something out of a tree, or to scare off a wild animal, or to burn for heat. There's something to be said for separating common uses from "inherent purposes". HTTP was certainly never designed to host as much dynamic content as it does now!
Re:Some of this stuff really makes alot of sense (Score:5, Insightful)
(http://localhost/)
What part of the word lightweight don't you understand?
PDF Link (Score:5, Informative)
(http://slashdot.org/)
On my ISP's very fast webspace, but please post mirrors in case they decide to pull the plug.
Where's the innovation? (Score:4, Interesting)
(http://www.seizurerobots.com/)
Sticking Knoppix distro in a DNS cache.... (Score:3, Interesting)
(Last Journal: Friday May 20 2005, @08:54AM)
PDF version (Score:2)
anybody remember DNS MUDs? (Score:5, Informative)
(http://www.needsfoodbadly.com/)
dangerous ideas, just think of akamai dns problems (Score:2, Interesting)
Yea baby! (Score:4, Insightful)
(http://www.ubasics.com/adam | Last Journal: Wednesday August 06 2003, @01:01PM)
We've got the Kaminsky protocol connected to the
DNS protocol
the DNS protocol's connected to the
UDP protocol
The UDP protocol's connected to the
IP protocol
Oh hear the word of the inefficient!
The second verse is left as an exercise for the reader. Please keep in mind that writing another verse is somewhat more productive than implementing the aforementioned Kaminsky protocol.
-Adam
protocol inversion (Score:1)
UDP over DNS. OTOH we have seen IT managers solemnly accepting
RPC over HTTP (SOAP) and TCP over HTTP (Web Services).
Whee, Slashdotted (Score:1, Informative)
(http://www.doxpara.com/)
Hi. Ask questions, I'll reply and eventually integrate into the Doxpara home page.
--Dan
Great ideas! (Score:2)
(http://www.pobox.com/~meta/ | Last Journal: Sunday February 29 2004, @09:19AM)
Re:Win2k DNS (Score:2, Insightful)
In other words kid, don't fuck with us old guys or we'll show you who knows shit!
Re:Win2k DNS (Score:4, Insightful)
(http://dsminc-corp.com/)
Re:WTF Is This? (Score:4, Funny)
(http://developers.sl...dMcMan/journal/33834 | Last Journal: Sunday May 18 2003, @10:16PM)
If you put the presentation in DNS it would not be a problem.
Re:Win2k DNS (Score:2, Interesting)
(http://cumulo-nimbus.com/)
I've never figured out how one of our network people was able to ACCIDENTLY add an NS record for one of our web servers instead of an A record, and I've definitely never figured out how it is that they couldn't understand what the problem was or how to fix it. They use Win2K on the DNS servers.
If it'd been Bind, they wouldn't have made the mistake in the first place, because there is no way you would accidently type "NS" instead of "A". Not to mention the fact that they probably wouldn't have attempted to make the change, and would have waited until the person who knew what he was doing was back.
I'm assuming that the person in question randomly clicked stuff until he had somewhere he could put a server name in....
Re:oh wow! (Score:2)
Re:oh wow! (Score:1)