Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Hackers gang up on Kaminsky over DNS flaw

But it's humble pie all round for vocal critics.

Article comments

Computer security professionals have ganged up on Dan Kaminsky for violating a cardinal rule of hackerdom: publicising a flaw without providing the technical details to verify the finding.

Kaminsky made headlines earlier this week by talking about a major flaw in the DNS software used to connect computers to each other on the Internet. In late March he grouped together 16 companies that make DNS software - companies like Microsoft, Cisco and Sun Microsystems - and talked them into fixing the problem and jointly releasing patches for it.

On Wednesday this week, he took things a step further on his blog, asking hackers to avoid researching the problem until next month, when he plans to release more information about it at the Black Hat security conference.

He said he wanted to go public with the issue to put pressure on corporate IT staff and Internet service providers to update their DNS software, while at the same time keeping the bad guys in the dark about the precise nature of the problem. A full public disclosure of the technical details would make the Internet unsafe, he said. "Right now, none of this stuff needs to go public."

He quickly received a sceptical reaction from Matasano Security researcher Thomas Ptacek, who blogged that Kaminsky's cache poisoning attack is merely one of many disclosures underlining the same well-known problem with DNS -- that it does not do a good enough job in creating random numbers to create unique "session ID" strings when communicating with other computers on the Internet.

"The bug in DNS is that it has a 16-bit session ID," he said via an e-mail Wednesday. "You can't deploy a new Web app with less than 128-bit session IDs. We've known about that fundamental problem since the '90s."

"Here comes the onslaught of interviews and media explosion for another overhyped bug by Dan Kaminsky," wrote a jaded (and anonymous) poster to the Matasano blog.

Over at the SANS Internet Storm Center, one blogger speculated that Kaminsky's bug had actually been disclosed three years earlier.

The flaw appears to be a serious one that could be exploited in what's called a "cache poisoning attack". These attacks hack the DNS system, using it to redirect victims to malicious websites without their knowledge. They have been known about for years but can be hard to pull off.

But Kaminsky claims to have found a very effective way of launching such an attack, thanks to a vulnerability in the design of the DNS surprised" by some of the negative reaction, but that this kind of scepticism was vital to the hacker community. "I'm breaking the rules," he admitted. "There's not enough information in the advisory to figure out the attack and I'm bragging about it."

According to DNS expert Paul Vixie, one of the few people who has been given a detailed briefing on Kaminsky's finding, it is different from the issue reported three years ago by SANS. While Kaminsky's flaw is in the same area, "it's a different problem", said Vixie, who is president of the Internet Systems Consortium, the maker of the most widely used DNS server software on the Internet.

The issue is urgent and should be patched immediately, said David Dagon, a DNS researcher at Georgia Tech who was also briefed on the bug. "With sparse details, a few have questioned whether Dan Kaminsky had repackaged older work in DNS attacks," he said. "It is not feasible to think that the world's DNS vendors would have patched and announced in unison for no reason."

By day's end, Kaminsky had even turned his most vocal critic, Matasano's Ptacek, who issued a retraction on this blog after Kaminsky explained the details of his research over the telephone. "He has the goods," Ptacek said afterward. While the attack builds on previous DNS research, it makes cache poisoning attacks extremely easy to pull off. "He's pretty much taken it to point and click to an extent that we didn't see coming."

Kaminsky's remaining critics will have to wait until his 7 August Black Hat presentation to know for sure, however.

The security researcher said he hopes that they show up for his talk. "If I do not have the exploit," he said. "I deserve every single piece of anger and distrust."



Share:

More from Techworld

More relevant IT news

Comments

What is all the fuss about said: If the major DNS suppliers did release patches then one of them is ISC that patched bind8 and bind9 These are open source should not be too difficult to see what they changed and see to what kind of vulnerability it points At least one can narrow the search



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *