DNS Flaw Discoverer Says More Permanent Fixes Will Be Needed Computerworld (07/17/08) Vijayan, Jaikumar
as it appeared in the July 21, 2008 edition of ACM TechNews.
Dan Kaminsky, a security researcher at IOActive who recently discovered a previously unknown cache-poisoning vulnerability in the Internet's Domain Name System (DNS) protocol, warned IT managers at a press conference on July 17 that while patches have been released to address the flaw, more may need to be done to address the issue over the next several months. Kaminsky noted that the patches that were issued in the wake of the discovery of the flaw earlier this month are at best a temporary measure aimed at protecting the DNS infrastructure from hackers trying to exploit the flaw, which exists in a transaction identification process that the DNS protocol uses to determine whether responses to DNS queries are legitimate. Kaminsky said that while DNS messages include what are supposed to be random identification numbers, only about 65,000 different values are currently being used as identifiers. Compounding the problem is the fact that the process of assigning identifiers to packets is not especially random and can be guessed, Kaminsky said. If hackers are able to identify the identification numbers on DNS messages, they could introduce forged data into the DNS system and redirect Web traffic and email to systems they control. Although the patches that aim to correct this vulnerability appear to be working, there are people who have gotten very close to exploiting it, Kaminsky said. As a result, IT managers should expect to see more security patches that aim to correct the flaw over the next several months. Click Here to View Full Article
