tyme July 21st, 2008 9:45 pm Nate: as I understand it, the additional RR is the key. You can’t keep requesting the foo.com NS record and trying to poison with f

tyme July 21st, 2008 9:45 pm Nate: as I understand it, the additional RR is the key. You can’t keep requesting the foo.com NS record and trying to poison with forged responses because it’ll be cached. You can keep requesting bogus_random.foo.com, because each different one will generate a new recursive query. Then mallory can reply with a foo.com NS record (or http://www.foo.com http://www.foo.com A record) as an additional RR. </quote> http://www.matasano.com/log/1105/regarding-the-post-on-chargen-earlier-today/#comments http://www.matasano.com/log/1105/regarding-the-post-on-charg... This is a good description of the attack.