Printable View
Yahoo news storyQuote:
Attackers could use the vulnerability to route Internet users wherever they wanted no matter what website address is typed into a web browser.
Security researcher Dan Kaminsky of IOActive stumbled upon the Domain Name System (DNS) vulnerability about six months ago and reached out to industry giants including Microsoft, Sun and Cisco to collaborate on a solution.
more details and online tool
Check to see if you have the vulnerability using the tool.
Interesting...
So...
Hack the world?
It only gets better, I suggest anybody running a DNS server who hasn't patched yet do it right now. Seems that a winner somehow released details of the vulnerability and promptly removed the entry in their blog but the googlebot got it cached before hand. Time to see how many people have been slacking about patching against this :/
Well that 'oops' in the matasano blog was pretty interesting to read indeed, although the DNS flaw has been heavy discussed in many places, I don't really think that is a problem that will be solved complety
For sure we know that mayor vendors, important companies and primary DNS services are and will be patched, however, is like everything regarding security, some admin in somewhere won't understand the magnitud of the problem, he'll read "someone could manipulate the DNS transaction ID and giving a new one" and the admin will say "eh...ok...and what's the problem? don't understand =/"
My point is that many security problem have maintained alive because people don't understand the implication of such problem thus don't pay attention to it nor will patch it
To me, after this whole publicity about the DNS flaw goes away, you still will find DNS servers vulnerable, maybe not Internet wise but local DNS servers and the like
Hang on tight, this is going to be interesting...
The latest is that some public speculation resulted in a temporary unraveling of the details (though the Internet's memory is eternal).
A little more here: http://www.pcmag.com/article2/0,1895,2326237,00.asp
OpenDNS is safe from this vulnerability. I would recommend people using their ISP's DNS servers to switch to OpenDNS. If you are curious as to the security of your current DNS, go to: DOXPARA.COM to test it's susceptibility to cache poisoning.
OpenDNS servers
208.67.222.222
208.67.220.220
I have 2 questions regarding this DNS issue. How come https only protects certain pages instead of protecting the whole website session? majority of sites turn encryption off after login. 2nd question: does the ip version 6 protocol has to be updated also? Just like the digital tv by 2009 bullying, vendors should starting rolling out the new internet since they are head deep into changing firmware.
blowback: Does this flaw also cause denial of service for legit sites? All browsers now have that anti-phishing feature. Would this hurt antionline if the evil antionline site convinced users to block the real antionline?
Sucks that this flaw been around since the birth of TCPip and we finally woke up. Now I know why government sites and NASA get hacked when they brag about their online security. Daemons being abused with root privs.
Has got nothing to do with DNS but with the way the website is set up.Quote:
Originally Posted by Linen0ise
IPv6 (as a protocol) has nothing to do with DNS. And yes, BIND using IPv6 would probably be just as vulnerable as on IPv4.Quote:
2nd question: does the ip version 6 protocol has to be updated also?
Err.. TCP/IP and DNS are 2 separate protocols. DNS runs on TCP/IP so we humans can easily remember where to go. Think of DNS as a giant phonebook.Quote:
Sucks that this flaw been around since the birth of TCPip and we finally woke up.
sirdice< read what I am saying.
From an application layer standpoint.........this dns crap can be defeated with certificates using 3-way authentication. A phony site couldn't survive without the proper signatures. Sort of like the 3 to 4 pin number unique to every credit\debit card.
I'm not talking about the geeky protocol crap.
I did.Quote:
Originally Posted by Linen0ise
Correct but that's not what you were asking.Quote:
From an application layer standpoint.........this dns crap can be defeated with certificates using 3-way authentication. A phony site couldn't survive without the proper signatures. Sort of like the 3 to 4 pin number unique to every credit\debit card.