Fuller figured out a nice application for Dan Kaminsky’s DNS hack —
using DNS servers on the public Internet as “dead drops,” with messages
stashed on them that can only be retrieved by people with the secret:
In each DNS query, 7 bits are reserved for a number of
flags, one of which is the Recursion Desired (RD) flag. If set to 0,
the queried DNS server will not attempt to recurse — it will only
provide answers from its cache.
Combine this with a wildcard zone and it’s possible to signal bits
(RD on), and read them (RD off). To set a bit to 1 the sender issues a
query with the RD bit on. The wildcard zone resolves all requests,
including this query. The receiver then issues a query for the same
hostname, with the RD bit off. If the bit is 1, the query will return a
valid record. If the bit is 0, no record will be returned.
So, it’s easy to signal a single bit, but what if you want to
share more than 1 bit of data? This requires both sides to compute a
list of records — one record for every bit of data we wish to send. In
my implementation, I chose to do this with a pre-shared word list and
initialization vector (IV). Given the same word list and IV, both
sender and receiver can independently compute an identical mapping of
words to bit positions. The sender can then signal the ‘1’ bits, and
the receiver can query all bits.