Patch for Web Security Hole Has Some Leaks of Its Own New York Times (08/09/08) P. B1; Markoff, John
as it appeared in the August 11, 2008 edition of ACM TechNews.
A Russian physicist has demonstrated that the emergency patch for the flaw found in the Domain Name System (DNS) is itself vulnerable. In a blog posting, physicist Evgeniy Polyakov wrote that he managed to get the patched DNS software to return an incorrect address in just 10 hours using two standard desktop computers and a high-speed network link. Internet experts who have reviewed Polyakov's work say the approach appears to be effective. The vulnerability of the DNS has been a hot topic since security researcher Dan Kaminsky notified a number of Internet companies about the flaw earlier this year. Kaminsky recently said the DNS flaw also could affect other Web services, including email. Although the risk of such a flaw has been known for some time, last month security engineers repeatedly stated that it is only a matter of time before financial organizations and others are attacked through the flaw. Packet Clearing House research director Bill Woodcock says there will almost certainly be an escalating number of attacks. "We have already been seeing attacks in the wild for the past two weeks," Woodcock says. Experts say the root of the problem is that modern networks are relying on an addressing system that was invented in 1983 and was not meant for services such as electronic banking that require strict identity verification. "They are relying on infrastructure that was not intended to do what people assume it does," says University of Southern California Center for Computer Systems Security director Clifford Neuman. "What makes this so frustrating is that no one has been listening to what we have been saying for the past 17 years." Click Here to View Full Article
