Skip to content

Comment on New DNS hijacking technique exploits RAM errorsparent

Comments

While I suspect you're right that the network path is more likely to error, udp does have a checksum that covers the entire payload so the DNS server would ignore the packet.

Also, the dns client is waiting for an address for the host that it requested. If it asks "where is alice?" and the dns server replies "bob is at x.x.x.x" it won't go there because the names don't match. So the error pretty much has to have happened on the client, but it could be a disk error, dma glitch, bug, malware or maybe a bad proxy/firewall.

The UDP checksum is fairly weak, so a packet with two bit errors can pass the checksum.

Still, I would attribute hits on mic2soft.com to human error with higher likelihood than transmission errors. Human error is around 10^-2 [http://panko.shidler.hawaii.edu/HumanErr/Basic.htm] compared to transmission errors below 10^-9 for non-broken networks.

The IP checksum is only 16 bits, so it will be fooled occassionally on a noisy line. Software that cares about correctness must use a proper error detection code of its own.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.