3 ms·

I think this may be the effect of the entire Turkish internet-going population hammering the google DNS servers. More importantly, does anyone know about the p

I think this may be the effect of the entire Turkish internet-going population hammering the google DNS servers. More importantly, does anyone know about the potential of man-in-the-middle DNS attacks? There is no https-like certificate based 3rd part validation for DNS, is there?

nmc 13y ago
Firstly, MitM attacks on DNS: totally free. Nothing is authenticated, all is plain text in UDP. Just intercept packet and change the answer. Secondly, no, there is no third-part validation for DNS. There is better. DNSSEC [1,2] takes advantage of the hierarchical nature of DNS to build a chain of trust. It does so by authenticating subdomain delegations, and signing resource records. Keep in mind, even though all DNS root servers now do DNSSEC, Internet-wide deployment is still ongoing and coverage is far from satisfying. [1] http://tools.ietf.org/html/rfc4033 http://tools.ietf.org/html/rfc4033 [2] http://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions http://en.wikipedia.org/wiki/Domain_Name_System_Security_Ext...
mrtksn 13y ago
About the MITM attack: TurkTrust, the only ssl certificate authority in Turkey, was recently involved in a huge scandal: http://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl-certificate-fiasco-what-happened-and-what-happens-next/ http://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl... Do you think that it's possible for the government to force TurkTrust to generate fake certificates for Google & Twitter and intercept the SSL traffic using TTNET? They did that, apparently by mistake, on the EGO(government company in Ankara) network by generating fake Google certificates. Is there something to stop them from doing this on national level? I don't think the ISP's would reject cooperation.