Stopping Kaminsky's DNS Attack with One iptables Rule

cipherdyne.org — Dan Kaminky's DNS cache poisoning attack will be released in detail at the upcoming Blackhat Briefings, so the exact details are not public yet. However, predictable UDP source ports chosen by bind are at the heart of the problem, so a single iptables "SNAT --random" rule can thwart such attacks for DNS servers protected by iptables. Jul 15, 2008 View in Crawl 4