DNS flaw strikes at heart of the internet

Serious security breaches possible as a result, says Frank Hayes

If you're a hard-core IT security wonk, you already know about this. If not, go to Doxpara.com right now and click on the button that says "Check my DNS". That will run a simple test to tell you whether your name server appears to be vulnerable to DNS cache poisoning.

No, really — right away. Doxpara.com. Go. Now. We'll wait.

Did the test say that you're vulnerable? Then you've got work to do.

Did it say that you're not? You've still got work to do.

Here's why: Early this year, security researcher Dan Kaminsky discovered a design flaw in the internet's Domain Name System, which translates names like Computerworld.com into IP addresses such as 65.221.110.98.

Kaminsky didn't find a bug in one DNS implementation. He found a vulnerability that's designed into every DNS server. That's right — they're all broken. Microsoft's version. And Cisco's. And BIND, which is widely used on Unix and Linux servers.

The design flaw allows an attacker to hijack domain names. Put simply, a victim would never know where the internet was taking him. Email could be redirected. Websites could be spoofed. Everything on the internet is at risk if an attacker takes over the DNS.

How do you fix a fundamental design flaw that affects the entire internet? Answer: You can't. So you don't. Instead, you find a way to make the design flaw much, much harder to exploit.

Kaminsky contacted Paul Vixie, who has been responsible for the BIND DNS server since 1988. Vixie called together the top DNS experts. In March, they secretly started work on the job of patching every major DNS implementation. Not with a fix — that would be impossible — but with a work-around.

On July 8, they all rolled out their patches at the same time. Microsoft. Cisco. AT&T. Sun. Red Hat. The BIND guys. Everybody.

This is not "a patch" to fix "a bug". This is a wake-up call for virtually the whole IT industry. The entire internet needs fixing. Yes, right now. And that includes every corporate network and every ISP.

Here's the good news: Because the flaw Kaminsky discovered is so baked into DNS, because it literally can't be fixed, the only good way to block it is to make it really hard for attackers to do anything bad to a DNS server. That's what the patches released earlier this month do.

As a result, those patches protect you not only from the design flaw Kaminsky discovered, but also from lots of other bugs that have been found over the years — and from bugs that haven't yet been discovered. It's the biggest and most effective internet security fix ever.

You want these patches on your DNS servers. You need them. If you're a CIO or an IT manager and you failed that test at Doxpara.com, you should start asking your networking guys when you'll no longer be vulnerable.

If you didn't fail the test, don't get cocky. Sure, the DNS server you're using is good. But are all of your network's DNS servers safe? What about the DNS servers of ISPs that your users connect to when they're on the road or working from home? What about business partners who connect to your systems across the Internet? They all need fixing.

And it won't all be as simple as testing and installing patches. Some older DNS servers haven't been patched. They'll need upgrades. Yahoo, for example, uses BIND Version 8. There's no patch for that, so Yahoo is upgrading its entire infrastructure.

See? There's work to do. Get to it. Now. Don't wait for the bad guys to figure out how to exploit this DNS flaw.

Because once they do, they won't wait for you.

Join the newsletter!

Error: Please check your email address.

Tags managementdoxparaDNSDan Kaminskyinternet

Show Comments
[]