Security Researcher Kaminsky Pushes DNS Patching 57
BobB-nw writes "Dan Kaminsky, who for years was ambivalent about securing DNS, has become an ardent supporter of DNS Security Extensions.
Speaking at the Black Hat DC 2009 conference Thursday, the prominent security researcher told the audience that the lack of DNS security not only makes the Internet vulnerable, but is also crippling the scalability of important security technologies. 'DNS is pretty much our only way to scale systems across organizational boundaries, and because it is insecure it's infecting everything else that uses' DNS, the fundamental Internet protocol that provides an IP address for a given domain name, said Kaminsky, director of penetration testing at IOActive. 'The only group that has actually avoided DNS because it's insecure are security technologies, and therefore those technologies aren't scaling.'"
One trick pony (Score:1)
I think I'll go with what Bruce Schneier and other security researchers suggest.
E
Re: (Score:3, Interesting)
Meh, I dunno about that. He's clearly got a pretty brain for finding flaws, and he's obviously got experience in the area, so he's a perfectly good cracker resource. You can't see everything from the security side - Whites and Greys need to have their input heard too.
Re: (Score:3, Interesting)
> I think I'll go with what Bruce Schneier and other security researchers suggest.
Which is...
Re: (Score:1, Funny)
http://www.google.com/ [google.com]
Re: (Score:2)
So Kaminsky is someone whose opinion is worth something.
Re:One trick pony (Score:4, Informative)
Why think when you can actually check?
http://tinyurl.com/dg5h7z [tinyurl.com]
See link 1, click once. Read the last two paragraphs. To me that seems like a published position.
Click the "back" button. Read the next few links.
Enjoy.
E
Re: (Score:1)
Re: (Score:1)
P.S. Google is your friend. Lend your friend money.
And them says... (Score:2)
Why think when you can actually check?
And they says the internat are not making us dumb.
Job title (Score:5, Funny)
Re: (Score:3, Funny)
Bombardier?
Re: (Score:2)
Re:Job title (Score:4, Funny)
-1 Tasteless
says someone who chose the handle Penguinshit
Re: (Score:2, Informative)
From memory, having read Pynchon's Gravity's Rainbow in the 1970s, and not since:
Who is Dan Kaminsky (Score:5, Informative)
Re:Who is Dan Kaminsky (Score:5, Informative)
http://blogs.technet.com/markrussinovich/archive/2005/10/31/sony-rootkits-and-digital-rights-management-gone-too-far.aspx
E
Re:Who is Dan Kaminsky (Score:5, Funny)
I think you're wrong... (Score:3, Informative)
I think you're confusing Dan with Mark Russinovich
I think GP isn't. It may be true that Mark discovered the rootkit, but I distinctly remember watching one of Dan's talks (at shmoocon, I think) in which he talks about him scanning udp/53 of teh w0hle intarnets and figuring out that a lot of caches knew about a name more or less only connected to the sony rootkit before Dan came and asked for it.
Dan did some research. Not all of it, and not the first of it, but some of it.
Re: (Score:2)
Ahem. As I was saying, it is good you brought up Mark since he deserves credit as well.
Re:Who is Dan Kaminsky (Score:5, Informative)
No, Kaminsky used an interesting technique to map the spread of the Sony rootkit - http://www.securityfocus.com/news/11369 [securityfocus.com]
Saying "he also did research regarding the Sony rootkit" is entirely accurate.
Re:Who is Dan Kaminsky (Score:5, Funny)
His picture is available online, and he looks like a regular decent guy, for whatever that's worth.
Sorry, he's not attractive enough for me to consider him a network security expert (what the hell???)
Re: (Score:2)
True point, but it can still give you some good information. When I look at him, he seems like a pretty nice guy. I could probably chill with him. He's not stylishly dressed, he's somewhat overweight, but he doesn't seem embarrassed at all that someone is taking a picture of him in that state (and he seems to be at some public event). From that you can conclude he's probably not ambitiously tr
Re: (Score:2)
Sorry, he's not attractive enough for me to consider him a network security expert (what the hell???)
It's documented fact that the wrinkles on your face are a result of the expression you tend to have on your face. Sour-pusses really are sour on the inside (No, I have not conducted a taste test to prove it. But anyway.) The expression on your face also influences your mood just as your posture does. Muscle memory works both ways! Neurons don't have diodes attached. So your mood influences your face influences your mood. If you see someone with a really sour look on their face all the time, guess what? They
Why is this a problem? (Score:2, Interesting)
Ok i am probably going to show my ignorance here, almost certainly, but it seems to me that this is a good thing, isn't it? Don't we want to have a secure DNS system? Or is it the case that securing the system will somehow limit our freedom or something like that?
Yes i know this is a very generic question but i would like to know
Re: (Score:1)
E
Re: (Score:2)
Also, deciding who gets to be "trusted" in any large scale cryptographic system is always good
Bad Article, Bad Summary (Score:5, Interesting)
Kaminsky supports patching existing nameservers (to increase query source-port entropy and thus make the so-called "Kaminsky" attack far less likely to succeed).
He also supports DNSSEC as the long-term solution to the whole class of vulnerabilities.
But these are not the same thing.
Patching DNS servers is done to the nameserver programs, DNSSEC is done to the nameserver configurations and to the DNS data itself.
The article, and Slashdot's summary of it, mixes up the two in an unfortunate salad. Very disappointing indeed.
MOD PARENT UP (Score:1)
Re:Bad Article, Bad Summary (Score:4, Funny)
mmmmmmmmmmmmmmmm... unfortunate salad
Re: (Score:2)
You forgot to mention that DNSSEC does nothing to make DNS more secure.
Why would engineers and scientists write a standard if it didn't work? Your statement doesn't make sense. Signing DNS information WILL make DNS more secure.
Re: (Score:2, Informative)
I don't want to bore those who are just here to increase their karma but security of DNS means both security of DATA and security of the TRANSFER of said data. The encludes AUTHENTICATION, ENCRYPTION, and secure endpoints to facilitate both without being compromised.
E
Re: (Score:1)
Sorry to disappoint you, but you can't "verify" DNS by "querying" if the original data are unprotected.
E
Re: (Score:3, Informative)
AUTH=Make sure you get your data from the right sources.
Okay.
ENCR=make sure the data are correct.
Huh?
Encryption makes the information secure from snooping, which is pointless in the case of DNS as it is public information by definition.
Signing makes sure the data has not been tampered with. Which is more or less the same as authentication.
Sorry to disappoint you, but you can't "verify" DNS by "querying" if the original data are unprotected.
That is the general idea of how SSL and the CA's work, only with DNS we don't really care if other people know what you are looking for, we just care that we are getting the correct response from the correct server, which requires signing of the responses, which
Re: (Score:3, Interesting)
This is true historically. However, I (this is Dan Kaminsky) think it's a mistake now. DNSSEC needs to be pushed into the nameserver's automated functionality about as deeply as possible. Administrators simply cannot be asked to maintain this data, manually resigning zones, manually keeping keys from expiring. It doesn't scale.
DJB discovered the "Kaminsky bug" (Score:4, Insightful)
I started to RTFA when something caught my eye: "his discovery of a significant DNS flaw -- known as the Kaminsky Bug"
Except Kaminsky wasn't the original discoverer of this bug (or the workaround). Dr. Bernstein is. Dr. Bernstein discusses hte Kaminsky bug here [cr.yp.to]; that page has been around since about late 2000 [archive.org].
For the record, I am no fan of DJB. I feel he has acted unprofessional and childlike at time; his response to an announcement of my DNS server on Bugtraq [derkeiler.com] being just one example of his inappropriate behavior. But, personal differences aside, I recognize he's a genius and that he's the original discoverer of this particular DNS issue.
(I also wish DJB would own up to the remote denial of service bug DjbDNS has, but that's another issue)
Re:DJB discovered the "Kaminsky bug" (Score:5, Informative)
djb thought potential exploits would appear without port randomization, but he didnt discover this particular flaw. Kaminsky did. As a car analogy, its like saying putting chips in keys keeps cars from being stolen, but coming up with a non-obvious hack that always starts the car without a key is its own work. Even Schneier says so [schneier.com]:
Kaminsky's vulnerability is a perfect example of this. Years ago, cryptographer Daniel J. Bernstein looked at DNS security and decided that Source Port Randomization was a smart design choice. That's exactly the work-around being rolled out now following Kaminsky's discovery. Bernstein didn't discover Kaminsky's attack; instead, he saw a general class of attacks and realized that this enhancement could protect against them. Consequently, the DNS program he wrote in 2000, djbdns, doesn't need to be patched; it's already immune to Kaminsky's attack.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
I think most OpenWRT/DD-WRT, etc, firewalls do srcport randomization reasonably well, at least if they're based on a reasonably new 2.4 or 2.6 kernel. There's a lot of home firewalls running those sorts of user-upgraded firmware. And there's a reasonable number of folks running a Linux/Netfilter based firewall either on their normally used computers directly, or on a dedicated firewall computer (say an old 586), too. Plus all those that went with a *BSD based firewall instead.
Sure, by absolute numbers, t
Re: (Score:2)
Re: (Score:2)
Don't worship DJB too closely. Remember the birthday attacks from 2002? DJBDNS only got patched against them a week or two ago...not even after I pointed out that their protection was missing, but after Kevin Day went ahead and built an exploit against it.
The only group that has actually avoided DNS (Score:2, Interesting)
Avoided? then WHAT is this: www.ioactive.com ???
Re: (Score:3, Informative)
Avoided? then WHAT is this: www.ioactive.com ???
It's a website, not a security technology.
If you want a security technology that uses DNS, ask for opportunistic IPSEC.