• Pharming:
  • Re-directing one site's traffic to another site
• DNS Spoofing/Poisoning:
  • A pharming technique that exploits weaknesses in DNS

• Recursive Queries:
  • If the DNS server does not know the answer it will ask another DNS server
  • The answer may be cached
• Transport Protocol:
  • DNS often uses a connectionless transport protocol that is easy to spoof (specifically, UDP)

• Step 1:
  • Make a query that (hopefully) server A can only answer by querying server B
• Step 2:
  • Send spoofed responses to server A that appear to come from server B (in response to server A's query)

• Source IP address
  
  Known
  
• Destination (i.e. authoritative server) IP address
  
  Knowable
  
• Source port
  
  Unknown
  
• Destination port
  
  Known (i.e., port 53)
  
• Transaction ID
  
  Unknown
  

• Source port
  • 16 bits
  • May not be random
• Transaction ID
  • 16 bits
  • Generated using a pseudo-random number generator

• Source port
  • $2^{16} = 65536$ possibilities, each of which are equally likely
• Transaction ID
  • $2^{16} = 65536$ possibilities, each of which are equally likely
• Probability of a "Correct" Response:
  • Since the two events are independent, $P\{\text{CorrectResponse}\} = P\{\text{CorrectPort}\} \cdot P\{\text{CorrectID}\} = \frac{1}{65536} \cdot \frac{1}{65536} = \frac{1}{4294967296}$ (i.e., about 1 in 4 billion)

• The Probability of One Attack Being Successful Depends On:
  • The amount of time between the request to the authoritative server and the response from the authoritative server (which is on the order of 0.1 sec)
  • The rate at which the attacker can transmit spoofed responses (which is probably on the order of 100000 per sec)
• The Probability of An Attacker Being Successful Depends On:
  • The amount of time the attacker is willing to devote to the effort

• The Idea:
  • Make more than one DNS query that will need to be re-sent to the authoritative server
• The Rationale:
  • The probability that one of the fake responses will correctly spoof one of the requests is higher (i.e., the Birthday "Paradox")

What is the probability that a member of a group of size $n$ has the same birthday as you?

Assuming all birthdays are equally likely, the probability that an individual has the same birthday as you is $\frac{1}{365}$. Hence, the probability of the complement (i.e., the individual doesn't have the same birthday as you) is $1 - \frac{1}{365} = \frac{364}{365}$.

So, assuming independence, the probability that $n$ people don't have the same birthday as you is $(\frac{364}{365})^n$.

Hence, the probability of the complement is $1 - (\frac{364}{365})^n$.

So, the probability that someone has the same birthday as you for $n=10$ is about 0.027, for $n=30$ is about 0.079 and for $n=50$ is about 0.128.

What is the probability that any two people in a group of size $n$ have the same birthday?

Let $B_i$ denote the birthday of individual $i$ and suppose we know the birthday of individual $1$. Then, as we just saw, the probability that individual $2$ has the same birthday as individual $1$ is $P\{B_2 = B_1\} = \frac{1}{365}$. Hence, the probability of the complement is given by $P\{B_2 \neq B_1\} = 1 - \frac{1}{365} = \frac{364}{365}$.

The probability that 3's birthday is the same as 1's or 2's, given that 1 and 2 do not have the same birthday, is given by:

$$P\{B_3 = B_2 \text{ or } B_3 = B_1 | B_2 \neq B_1\} = \frac{1}{365} + \frac{1}{365} = \frac{2}{365}$$

Hence, the probability of the complement is given by:

$$P\{B_3 \neq B_2 \neq B_1 | B_2 \neq B_1\} = 1 - \frac{2}{365} = \frac{363}{365}$$

and:

$$P\{B_3 \neq B_2 \neq B_1\} = P\{B_3 \neq B_2 \neq B_1 | B_2 \neq B_1\} \cdot P\{B_2 \neq B_1\} = \frac{364}{365} \cdot \frac{363}{365}$$

Generalizing, the probability that $n$ individuals have different birthdays is given by:

$$\frac{364 \cdot 363 \cdot (365-n+1)}{365^{n-1}}$$

Multiplying by $\frac{365}{365}=1$, this probability is given by:

$$\frac{365 \cdot 364 \cdot 363 \cdot (365-n+1)}{365^{n}}$$

This can be re-written as:

$$\frac{365!}{(365-n)!} \cdot \frac{1}{365^n}$$

Thus, the probability of the complement (i.e., that any two people share a birthday) is just:

$$1 - \left(\frac{365!}{(365-n)!} \cdot \frac{1}{365^n}\right)$$

So, the probability that any two people share a birthday for $n=10$ is about 0.117, for $n=30$ is about 0.706 and for $n=50$ is about 0.970.

• Domain Hijacking:
  • Domain name registrations expire
  • If the legitimate owner of a domain name forgets to re-register, another party can register the name and direct traffic to its servers
• Use of Similar Domain Names/Typosquatting:
  • Register domain names that are similar to the domain name of a "well-known" site (e.g., common misspellings, names involving nearby letters)
• Bitsquatting:
  • Register domain names that are one bit different from the domain name of a "well-known" site
  • This is tantamount to typosquatting but is motivated by hardware/transmission errors rather than human errors (e.g., a transmission error in one bit changes microsoft.com to micro3oft.com)