DNS Attacks

[bruce]

but if a bank employee is involved in the taking of funds, then there is
somewhat of a trail. if the employee where to "change" the root dns servers,
there would be some trail of this with the service that the bank uses for
this setup.. this would be pretty easy to resolve, and the customer would
have protection (although suffer a hassle) as the bank would back up the
funds that were stolen...

the issue of dns poisoning would also be resolved in a matter of time, but
unfortunately, there might be multiple customers who are impacted...

after thinking on this for awhile, the only thing that i can really think of
to make a site "safe" is for you the customer to get your behind into a
physical setup/location/building when you initially setup the online
account!!! and then you should only use sites that incorporate multi-pass
(two factor) security processes. (although this has it's own set of
issues!!)

for my own $0.02 worth, i find myself going to different parts of a site to
see if i get links that return me back to where i should be prior to
inserting my login information... but this implies that you know what a
site's structure should be!





-----Original Message-----
From: fedora-list-bounces at redhat.com
[mailto:fedora-list-bounces at redhat.com]On Behalf Of Mikkel L. Ellertson
Sent: Saturday, July 26, 2008 6:01 AM
To: For users of Fedora
Subject: Re: DNS Attacks


Björn Persson wrote:
> Les Mikesell wrote:
>> You aren't paranoid enough.  What if the spoofer is also a system
>> administrator at the bank with access to a copy of the real certificate
>> that he installs on the machine he's tricked your dns into reaching -
>> with the expected name that you'll still see.
>
> Then the bank has failed to protect its secret key. I expect banks to have
> rigorous security routines to control who can access sensitive systems,
and
> to be able to check afterwards who did what.
>
> Could you elaborate on how whois guards against malicious system
> administrators? Do you think security could be improved by having browsers
> and other programs make whois queries automatically?
>
> Björn Persson
>
Also, if it is the a system administrator at the bank, what is to
prevent him from just changing the real name servers? Or putting in
a program on the bank's web server to capture the username and
password when you enter them? Lets face it, if a bank employee wants
to embezzle money from the bank, there is not much we as costumers
can do about it.

Mikkel
--

   Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!