2 ms·
Linux has a serious security problem that once again enables DNS cache poisoning
- LinuxBender 5y agoThe side channel is ICMP redirects. Folks following the guidance from the CIS or NIST benchmarks will have disabled ICMP redirects. For this to work, your recursive DNS server must be publicly accessible and allow ICMP redirects on the server. Most of the public recursive servers are behind load balancers so I would be curious to see penetration testing results of the public recursive systems like Cloudflare, Google, OpenDNS and others like them.
- t0mas88 5y agoAnother reason for TLS / HTTPS everywhere. You can't trust an unauthenticated connection, even if your DNS is fine there are many other ways in which you are vulnerable if the connection isn't secure.