Search:  

 
 
   News
newer
story category DNS Flaw Even Worse Than Predicted
Kaminsky explained scope of threat at Black Hat this week
(old news - 01:34PM Thursday Aug 07 2008)
tags: security · trouble
Tipped by borredo See Profile
Earlier this summer security researcher Dan Kaminsky reported that there was a major DNS design flaw posing a serious security threat to Internet users. Businesses worked together to create a patch for the problem but Kaminsky spoke yesterday at the Black Hat conference about how large the implication of this threat actually is, indicating that it’s worse than originally publicized.
"The flaw basically allows hackers to poison the cache of any vulnerable recursive DNS server, which in turn allows attackers to send users to malicious Web sites. But as Kaminsky revealed in his talk, attackers can use the flaw to target a number of applications and protocols, including the FTP and SSL (Secure Sockets Layer) certificates validated via the Web."
Kaminsky compared the problem to a game of dominoes in which the first exposure to security threats could cause additional problems. There are a lot of proposed solutions to the problem but there are no solutions that specifically appear to be capable of fixing the issue at this time.

Related:
  1. Major DNS Flaw Finally Publicized
  2. Thursday Evening Links
  3. Monday Morning Links
  4. Friday Evening Links
  5. Wednesday Evening Links
  6. PA Man Charged With Selling Hacked Cable Modems
  7. FoxNews.com Serving Up Infected Ads?
  8. T-Mobile Systems Hacked?
Forums » DNS Flaw Even Worse Than Predicted
view: topics flat text 
Post a:
B
Premium,MVM
join:2000-10-28


1 edit

FTP "Certificates"?

Huh? (Too lazy to read the articles.)

Edit: But having skimmed the Slashdot discussion
»tech.slashdot.org/tech/08/08/07/···52.shtml

it's quickly clear that this is no "news" at all. It's simply a reminder to newbies that DNS affects most Internet-based transactions, not just web traffic.

-- B
--
In a realm outside causality and function

chronoss2008
Premium
join:2008-03-29

site to send too

haha send em to bells tech support , that will have yah in a never ending loop forever......

BSD24
Tier 4
Premium
join:2008-04-30
Middleboro, MA
clubs:

Re: site to send too

Or Verizon's support in general, specially DSL. the automated system for dsl will tell them to call back at a later time because they are too busy to take their call.
--
BSD

blackzero
Premium
join:2007-08-16
Trois-Rivieres, QC
·Cogeco Cable
·Cogeco Voip
·Bell Sympatico

Imagine now future hacking attacks!

Imagine now getting into a hacker's private server by only going to »https://www.paypal.com/

Some software also uses hostnames for auto-updating features. Imagine now downloading virus by going to windows update or something like that.

I hope that flaw will be fixed soon.....
jgantert

join:2004-06-02
Columbia, MD

Verizon DNS still ranks POOR

I'm suprised, just ran the tests again, and my Verizon FiOS DNS servers (71.242.0.12 and 71.252.0.12) still come back as POOR. Very suprising. I can't belive they haven't patched them yet!

Glad I switched to OpenDNS a while back!

MoeDumb
I already have a Messiah.
Premium
join:2002-09-23

Re: Verizon DNS still ranks POOR

said by jgantert See Profile :

Glad I switched to OpenDNS a while back!
Can someone explain why OpenDNS remains immune?
--
Who is Jesus? and Why it matters (to YOU).
B
Premium,MVM
join:2000-10-28

Re: Verizon DNS still ranks POOR

"Remaining" immune isn't a problem. Once a server is properly reconfigured, you're done, pretty much.

The unpatched servers are run by people who are either (a) lazy, (b) irresponsible, or (c) cheap. Pick three.

-- B
--
In a realm outside causality and function
jgantert

join:2004-06-02
Columbia, MD

Re: Verizon DNS still ranks POOR

said by B See Profile :

The unpatched servers are run by people who are either (a) lazy, (b) irresponsible, or (c) cheap. Pick three.
(d)Incompetent
B
Premium,MVM
join:2000-10-28

Re: Verizon DNS still ranks POOR

Okay, pick four.

-- B

scelli
Native New Yorker
Premium
join:1999-08-07
USA

Re: Verizon DNS still ranks POOR

said by B See Profile :

Okay, pick four.

-- B
Here's one more:

(e)-need to be unemployed.
--
The maximum effective range of an excuse is ZERO meters!

LeftOfSanity

join:2005-11-06
Felton, DE

Re: Verizon DNS still ranks POOR

said by scelli See Profile :

said by B See Profile :

Okay, pick four.

-- B
Here's one more:

(e)-need to be unemployed.
Should have stopped at (d)

scelli
Native New Yorker
Premium
join:1999-08-07
USA

Re: Verizon DNS still ranks POOR

That's your opinion, but I meant exactly what I said.

Period.
--
The maximum effective range of an excuse is ZERO meters!

LiamJunket
Premium
join:2002-03-03
Ocean City, NJ
·Comcast

said by MoeDumb See Profile :

said by jgantert See Profile :

Glad I switched to OpenDNS a while back!
Can someone explain why OpenDNS remains immune?
OpenDNS's founder and CEO says here that OpenDNS's servers were never vulnerable and he posted on his blog that he would explain later why that was the case. But he never did.
»blog.opendns.com/2008/07/08/open···ou-safe/
I’m very proud to announce that we are one of the only DNS vendor / service providers that was not vulnerable when this issue was first discovered by Dan. During Dan’s testing he confirmed (and we later confirmed) that our DNS implementation is not susceptible to the attack that was discovered.

We’re going to write more about this issue in the next 24 hours to address the vulnerability in detail and explain why we aren’t affected but I wanted to get the word out now so that you know you are safe using OpenDNS.
Maybe he thought better of putting out on the internet why his DNS servers are immune for fear of giving hackers ideas on how to attack his servers. If I were him I wouldn't be giving out any info that might make life easier for the scum hackers of the world.
--
My BLOG .. .. Internet News .. .. My Web Page
Ask yourself one question: 'Do I feel lucky?' Well, do ya punk?

digitalfreak

join:2005-12-09
49533

Re: Verizon DNS still ranks POOR

I'm sure the "scum hackers of the world" are trembling in fear of your quick wit.

Anonymous_
Anonymous
Premium
join:2004-06-21
127.0.0.1
clubs:
i use Level 3 they ARE 20% faster in ms
jgantert

join:2004-06-02
Columbia, MD

Re: Verizon DNS still ranks POOR

Yeah, those DNS servers look good now that they are patched.

Anonymous_
Anonymous
Premium
join:2004-06-21
127.0.0.1
clubs:
·RoadRunner Cable
·Time Warner Cable
·Time Warner VOIP

Re: Verizon DNS still ranks POOR

said by jgantert See Profile :

Yeah, those DNS servers look good now that they are patched.
well on Avg level 3 servers are 7 ms faster then TWC's shit servers
battleop

join:2005-09-28
00000

Re: Verizon DNS still ranks POOR

Hah a whole 7ms.

GemSnake
Premium
join:2000-10-19
3rd layer
clubs:
7ms will save the world. True story.

Pee. Ess. Give me an effin break!

Anonymous_
Anonymous
Premium
join:2004-06-21
127.0.0.1
clubs:

Re: Verizon DNS still ranks POOR

yea but google takes 20second LAG to load with TWC dns server with level3 1 seocnd

GemSnake
Premium
join:2000-10-19
3rd layer
clubs:

Re: Verizon DNS still ranks POOR

said by Anonymous_ See Profile :

yea but google takes 20second LAG to load with TWC dns server with level3 1 seocnd
You do realize that 20 seconds is 20,000ms, right? Your query will time out way before that.
--
"In a fight between you and the world, bet on the world." - Franz Kafka

Anonymous_
Anonymous
Premium
join:2004-06-21
127.0.0.1
clubs:

Re: Verizon DNS still ranks POOR

the page Stalls

backfeed
is giving feedback

join:2002-12-16
Peru, IN
·Comcast Digital Vo..
·Comcast Formerly ..

Not trying to be critical, and I have used Level 3's NS servers a few times in a pinch..(mainly because I can remember the address), But I wonder what L3 thinks of all of the people that use them? I suppose if it was a big issue they would close them up, but since OPENDNS came into being, I have had good luck with them and the price is right .
With some of the filter options we can get, I find it a great service....
thoughts anyone??
--
ERROR: Out of Memory... Should I forget Something (Y,y)?

Dryvlyne
Far Beyond Driven
Premium
join:2004-08-30
Newark, OH

So basically...

the entire Internet as we know it really should be rebuilt from the ground up to truly nip this flaw. I guess this is just what happens when the most fundamental of all Internet protocols gets a huge hole in it, everything else that rides on top of it immediately becomes vulnerable as well.

Well, I suppose we can all start memorizing and using the IP addresses of our favorite sites to ensure we're really getting to the site we requested
--
In relative terms life is shorter than the blink of an eye. Remember that each and every day because in the end it's not about what you've done but how you've lived.

RevMortis
I Hear Dead Silicon
Premium
join:2005-05-10
Saint Paul, MN

Re: So basically...

Not so. Sites that use a shared hosting service make the DNS an integral part of the address.

200 sites same IP address. IP addy will take you to the hosting service website.

Angralitux

join:2004-05-20
DO

Online tests ??

can someone point to online tests or procedures to see if a friend's friend is vulnerable ?

Please not the one on Dan's blog, that one never works.
--
All Is possible...

scelli
Native New Yorker
Premium
join:1999-08-07
USA

Re: Online tests ??

said by Angralitux See Profile :

can someone point to online tests or procedures to see if a friend's friend is vulnerable ?

Please not the one on Dan's blog, that one never works.
»https://www.dns-oarc.net/oarc/services/dnsentropy
--
The maximum effective range of an excuse is ZERO meters!
Forums » DNS Flaw Even Worse Than Predicted


Sunday, 05-Jul 10:00:42 Terms of Use | Privacy Policy | Hosting by www.nac.net - DSL,Hosting & Co-lo | feedback | contact
over 9.5 years online! © 1999-2009 dslreports.com.