ALT-25 · Paper · 23 Oct 2026
Kaminsky's attack: poisoning DNS in seconds
In 2008 Dan Kaminsky found a way to poison a DNS resolver's cache for any domain, quickly and reliably. It led to the largest coordinated patch the internet had seen — and a renewed push for DNSSEC.
- Early 2008Kaminsky finds the flaw and brings DNS vendors together in secret.
- 8 Jul 2008Coordinated patches across vendors: randomise the UDP source port (CVE-2008-1447).
- Aug 2008Full details presented at Black Hat; exploit code had already leaked.
How it worked
Earlier cache poisoning had to wait for a cached record to expire. Asking for random123.example.com forces a fresh lookup every time, so the attacker can race again and again. The forged reply carries extra records that rewrite where example.com itself lives.
The fix added randomness to the source port, multiplying the guesses needed. It made the attack harder, not impossible; authentication of answers needed DNSSEC.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- 16 bits of randomness is a speed bump, not a lock.
- Coordinated, quiet disclosure across many vendors can work — it did here.
- Infrastructure built on unauthenticated answers depends on everyone else behaving.
What it means for you
- Run resolvers that validate DNSSEC, and sign your own zones.
- Make sure NAT and firewalls do not de-randomise resolver source ports.
- Do not run open resolvers; restrict who can query yours.
Sources
Altumptic was not involved in this research. Figures are as published by the sources above.
Cite this entry
Altumptic Lab (2026). ALT-25 — Kaminsky's attack: poisoning DNS in seconds. 23 Oct 2026. altumptic.com/research/kaminsky-dns-2008