2. * Agenda  What is the DNS ?  Poisoning the cache  Short term solution  Long term solution

3. * a hierarchical naming system built on a distributed database for computers, services, or any resource connected to the Internet or a private network

4. * Zone * Nameserver * Authoritative Nameserver * Resolver * Recursive Nameserver * Resource Record * Delegation

5. A simple DNS query

6. What's in a DNS packet?

7. The packet in the step 7

8. What's in the cache?

9. * Step 1: * Guessing the Query ID and Port Number * Step 2: * Flooding the target nameserver

11. * Version 1

12. * Version 2

13. * Maximise the amount of randomness  randomizing the Port Number and Query ID  Even patched servers may still be vulnerable if an intervening firewall performs Port Address Translation in a way that un-randomizes the source ports * Disable open recusive name servers  If you must run a recursive name server, limit access to only those computers that need it. (e.g. your customers)

14.  DNSSEC is the current answer to this problem