Slashdot Log In
DNS Inventor Tackles Flaw
Posted by
ScuttleMonkey
on Monday November 10, @10:57AM
from the always-evolving dept.
from the always-evolving dept.
nk497 writes "Dr Paul Mockapetris is looking to fix the flaws in the Domain Name System he helped invent. 'It was never meant to be the only security mechanism for naming data on the internet, but was intended for additional security measures to be added to it later.' The flaws, first uncovered by security researcher Dan Kaminsky over the summer, lets attackers redirect genuine URLs to malicious ones — a problem Mockapetris believes could be solved using digital signatures."
Related Stories
[+]
Kaminsky's DNS Attack Disclosed, Then Pulled 281 comments
An anonymous reader writes "Reverse engineering expert Halver Flake has recently mused on Dan Kaminsky's DNS vulnerability. Apparently his musings were close enough to the mark to cause one of the Matasano team, who apparently already knew of the attack, to publish the details on the Matasano blog in a post entitled 'Reliable DNS Forgery in 2008.' The blog post has since been pulled, but evidence of it exists on Google and elsewhere. It appears only a matter of time now before the full details leak."
Reader Time out contributes a link to coverage on ZDNet as well.
[+]
Kaminsky DNS Bug Claimed Fixed By 1-Character Patch 120 comments
An anonymous reader writes "According to a thread on the bind-users mailing list, there is nothing inherent in the DNS protocol that would cause the massive vulnerability discussed at length here and elsewhere. As it turns out, it appears to be a simple off-by-one error in BIND, which favors new NS records over cached ones (even if the cached TTL is not yet expired). The patch changes this in favor of still-valid cached records, removing the attacker's ability to successfully poison the cache outside the small window of opportunity afforded by an expiring TTL, which is the way things used to be before the Kaminsky debacle. Source port randomization is nice, but removing the root cause of the attack's effectiveness is better."
Update: 08/29 20:11 GMT by KD : Dan Kaminsky sent this note: "What Gabriel suggests is interesting and was considered, but a) doesn't work and b) creates fatal reliability issues. I've responded in a post here."
Update: 08/29 20:11 GMT by KD : Dan Kaminsky sent this note: "What Gabriel suggests is interesting and was considered, but a) doesn't work and b) creates fatal reliability issues. I've responded in a post here."
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Hmm... (Score:4, Insightful)
Ok, so this approach where you release something half-way done and fix it later is much older than I thought.
Reply to This
Re: (Score:2, Funny)
Re:Hmm... (Score:5, Insightful)
Ok, so this approach where you release something half-way done and fix it later is much older than I thought.
Well, yeah. Here's the first instance I know of:
Carl: Hey, I just figured out that by attaching a piece of slate and some handles to this thing I call the "wheel", I can haul around deer carcasses much more easily than my previous method of throwing them over my shoulder and crawling. I call this new contraption the "wheelbarrow".
Lenny: That's great! I think that I'll use it to haul home my fiance after I propose by clubbing her over the head. When I'm moving people around with it, I'll call it a "car". Of course, if anyone wanted to use the "car" for frequent trips or moving multiple people around, they'd have to make significant improvements.
Homer: Your car sucks. Why in the hell did you design it like this? This thing looks like it was made to haul around deer carcasses, not people! This is obviously an incomplete solution - Why did you show it to us without perfecting it first!?! You're an idiot.
Preemptive retort to silly overly-critical responses: I agree, it is a deeply flawed analogy. It's primary intent was humor while only lightly relating to the incomplete implementation of the DNS system.
Cheers.
Reply to This
Parent
Re: (Score:3, Funny)
Thank you for using a car analogy
I tried to RTFA... (Score:5, Funny)
... but it seems that a DNS attack redirected it to a fluff piece without any useful content.
Reply to This
Law is only way (Score:2, Insightful)
Really, the only way to get ISPs to offer secure DNS protocols is to require it by law. Otherwise, its just their nature not to do, to be lazy and ignore it, as they do with IPv6. So mandate it by law I say.
Re: (Score:2, Informative)
Re:Law is only way (Score:5, Insightful)
True enough, but the Almighty Invisible Hand of the Free Market isn't taking care of this, either.
Reply to This
Parent
Re: (Score:3, Informative)
The free market can not exist in environments where the government gives special monopolies to a few companies. The only real competition in this market is for these companies to protect their monopolies.
John D. Rockefeller said, "Competition is a sin."
A great muckraking book on this topic is Confessions of a Monopolist, written in 1903.
This kind of thing has been going on ever since the Supreme Court brazenly declared that a corporation has the same rights as a natural person.
Re: (Score:3, Informative)
It's trying to, but something is protecting the bankers.
Hm, that and DNSsec sucks ass (Score:4, Informative)
Look at the history of DNSsec; the specs have been done and redone several times over, there is no consensus, and it looks like it would be a bitch to admin.
Reply to This
Parent
Re:Hm, that and DNSsec sucks ass (Score:5, Interesting)
Can someone explain what is the point of DNSsec? An https website already has its own certificate which authenticates you are talking with the right person, and https is designed to be secure without trusting DNS. If DNSsec had been widely implemented twenty years ago then secure protocols might have evolved in a different direction, but given where we are now, what problem does DNSsec solve?
Similarly if you use ssh then the server authenticates to you with its own keypair. You don't need to trust that DNS gives the right answer.
Is DNSsec just to stop denial of service attacks on the DNS infrastructure and trivial hijacking of insecure protocols like telnet and http?
Reply to This
Parent
Re:Hm, that and DNSsec sucks ass (Score:5, Interesting)
Can someone explain what is the point of DNSsec? An https website already has its own certificate
DNS is a naming service, but it was never designed to be a trustworthy naming service. If it was, then DNS spoofing would have been impossible. Another reason why, currently, SSL certificates are needed is IP address spoofing. But if your certificate is embedded in a DNS entry then there is no reason for anyone to need a third-party-signed certificate at all. All you really need is a single source of trust. Right now we have 2: the root nameservers and the root SSL certificate authorities.
So if we fix DNS then we can skip SSL root CAs entirely and just go with DNS. But SSL certs are a lucrative business, which is why Verisign et. al. don't want DNS to be fixed. It would be the end of their best cash cow. But fixing it is necessary for the internet to become a truly trustworthy place of business.
The article, BTW, strikes me as odd. Isn't it Paul Vixie who has been campaigning for DNSSEC for ages now? He isn't even mentioned.
Reply to This
Parent
Re:Law is only way (Score:5, Funny)
You always have the option to boycott that ISP, but if you live somewhere like I do, you only have one broadband option.
I see you're using the sense of "always" that means "occasionally" or even "very rarely."
Reply to This
Parent
Re:Law is only way (Score:4, Funny)
Reply to This
Parent
Re: (Score:2)
I don't need it to survive as such, but internet access is pretty much a job requirement when working in my field, so I need it to buy food. :D.
Re: (Score:2)
Just like central heating, electricity, piped water supplies, and your car.
Re:Law is only way (Score:5, Insightful)
So if your internet at home went down, would you wither up and die?? Or just a little inside?
No, but considering the fact that I live over 1,500 miles from the office where I work, it is not merely a luxury that I telecommute. If I can't have broadband Internet, I'll need to quit my job and find another, convince my wife to quit her job and sell our house during the housing market slump so we can move (either somewhere I *can* have broadband Internet, or somewhere within driving distance of my company's office), or leave my wife behind so I can move. I can't simply boycott the only broadband ISP in my area on a whim, as you suggest -- it is a much, much bigger issue for me.
You're creating the false dichotomy that everything which is not necessary to survive is a luxury. I agree that I do not strictly need broadband Internet to survive, but disagree that the Internet is a luxury, for me at least. Perhaps you would have no problem boycotting utility companies if you felt they were doing something irresponsible, since after all electricity, water, natural gas, etc are not necessary for survival (and in fact many people in the world do not have these things), but most people in the US would argue that they are more than luxuries. Maybe you are lucky enough to have well or cistern water, and live in a climate where winter heating isn't necessary for survival, or perhaps you have a wood-burning stove/fireplace that could heat your house if you don't have electricity or natural gas -- but that doesn't mean that they are luxuries for everyone, irrespective of the circumstances of that person's life.
Those are more extreme examples, but the fact is that my life is currently based around having broadband at home, and although I could do without it (just as I could do without electricity, natural gas, and city water), I would need to make very large changes to my life to do so.
Reply to This
Parent
Re: (Score:3, Funny)
"Take the American government"
Fixed it for you
Take the American government please.
Mockapetris (Score:5, Interesting)
Reply to This
DNSsec (Score:2, Interesting)
No need to fix this problem (Score:4, Insightful)
Then we'll find ourselves longing for the current DNS problem.
Reply to This
Re: (Score:2)
Not just new here, very, very new here.
Re: (Score:3, Informative)
Re:We'll add security later (Score:5, Informative)
Not really. Back when DNS was invented (1982) pretty much everything connected to the Internet was essentially a trusted machine. Arguably that was almost true until the Morris worm in 1988. Of course you could never truly trust them, but the idea was that if someone did something silly other people would phone them and then they would stop. Essentially it was an anarchy populated by non malicious people.
Reply to This
Parent