*Nobody uses DNSSEC, so it's still easy to poison DNS caches* I'm not sure if th... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		trotsky on Nov 30, 2010 \| parent \| context \| favorite \| on: BitTorrent Based DNS To Counter US Domain Seizures Nobody uses DNSSEC, so it's still easy to poison DNS caches I'm not sure if that's accurate - I believe source port randomization has made it extremely difficult to poison recursive DNS servers. I think a recent "successful" attack on source port randomizing showed it took them 7 hours on a 10Gb/s link to poison one A entry.

jrockway on Nov 30, 2010 [–]

4chan has 7 hours and a 10Gb/s link.

trotsky on Nov 30, 2010 | [–]

per resolver

jrockway on Dec 1, 2010 | | [–]

per resolver.

Think about how much bandwidth is used every day for downloading porn. Use 1% of that for poisoning DNS, and DNS points wherever the poisoners want it to.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact