Internet domain system open to fraudulent attack, expert says

Matthew Broersma   Today’s Top Stories   or  Other Security Stories  

The Secure Web Gateway. Mission Critical For Business Get a Grip on Storage Growth and Reduce Costs What's Next? Real Answers for Tough Times Next-Gen Load Balancing: 3 Keys to Successful Delivery of Advanced Web Apps Advanced Load Balancing: 8 Things You Need to Handle Today's Network Traffic Infoblox IP Address Management Solutions Brief Computerworld Report- Large Enterprises Pay More for IPAM Mobility @ the Speed of Business Computerworld Report- Large Enterprises Pay More for IPAM Sign up to receive Networking and Internet Resource Alerts

August 5, 2005 (TechWorld.com) -- A large number of DNS servers, a critical part of the Internet's infrastructure, are vulnerable to attacks that could lead to widespread fraud, according to a security researcher.
A scan conducted by Dan Kaminsky, a networking security expert, has found that hundreds of thousands of DNS servers could be vulnerable to a type of attack that routes Internet traffic to malicious websites.
The attack technique, known as DNS cache poisoning, came to public attention when attackers used it to redirect traffic from a large number of financial, entertainment, travel, health and software sites to attackers' servers in order to install malicious code (See DNS 'pharming' attacks target .com domain) .
Despite the danger, large numbers of servers are still configured in a way that allows the attack to take place, according to Kaminsky. In a scan of about 2.5 million DNS servers, he found that about a tenth, or 230,000, could be vulnerable.
Domain Name System (DNS) servers host a distributed database that allows the translation of domain names (e.g. name.com) to IP addresses. They also route e-mail by listing each domain's mail exchange server. In a cache poisoning attack, a DNS server is compromised so that a legitimate domain name resolves to the attacker's IP address, which can present the user with anything the attacker chooses.
Such techniques have been around for years, but the April incident demonstrated that they are not just theoretical. Nevertheless, many DNS servers have been left in the same vulnerable configurations that were exploited in April. DNS servers are run by all manner of organizations, including corporations and Internet service providers.
At least 230,000 of the servers scanned are configured to forward DNS requests to BIND8 DNS servers, according to Kaminsky. This was one of the vulnerabilities exploited in April, according to the SANS Institute, a security organization. Of those, 13,000 are Windows name servers forwarding to BIND8, making them exceptionally high risk, Kaminsky said. Another 53,000 at least are very likely to be vulnerable, he said.
The Internet Software Consortium (ISC), which distributes the widely used BIND software, specifically states that BIND4 and BIND8 aren't suitable to act as targets for name server forwarders, because of the ongoing danger of DNS cache poisoning. "There is a current, wide scale Kashpureff-style DNS cache corruption attack which depends on BIND4 and BIND8 as 'forwarders' targets," ISC stated on its Web site. "Upgrade all nameservers used as 'forwarders' to BIND9."
K aminsky said has only been able to scan a fraction of the existing name servers so far, which he estimated at 9 million.
Kaminsky published some of his findings on the Web site of hisfirm, DoxPara Research , earlier this week. He presented the findings last week at the Black Hat security conference.

Reprinted with permission from

For more enterprise technology news from the U.K., please visit TechWorld.com. Copyright 2006 IDG, all rights reserved.

Print this Story

Send Us Feedback

E-mail this Story

Digg this Story

Slashdot this Story

"Some Asian airlines are reporting rising losses to inflight credit card fraud because there is typically no online credit-card authorization..." Read more... Read more Security posts or See all Blogs

BlackBerry Storm sales should be strong, Verizon says Microsoft to launch IE8 in '09; RC due out in Q1 Google shutters its Lively virtual world More top stories...

Review: BlackBerry's Storm is awkward and disappointing Microsoft dissed Intel's 915 chip set before making 'Vista Capable' changes NASA sniffs out trouble with electronic nose on space station

2008 Salary Survey: IT pay takes tiny leaps If you're like our 7,000 survey respondents, your paycheck this year has been flattened and your bonus obliterated. We offer 12 ways to plump up your paycheck. Windows 7 in-depth review and video: This time Microsoft gets it right Microsoft's next OS might more accurately be called Windows 6.5: It's essentially a better version of Vista. Twitter for business: 5 ways to tap the power of the tweet Twitter can be a valuable business tool -- if you know what you're doing. Here's how to juice it for all it's worth. Microsoft's 'Vista Capable' changes outraged HP, insider e-mails show By helping Intel with loosened 'Vista Capable' requirements, Microsoft 'severely damaged' its credibility, said an HP exec in a newly unsealed Feb. 2006 e-mail. Windows 7 Get the latest news, reviews and more about Microsoft's newest desktop operating system More Continuing Coverage Windows 7 Voting Technology Google's Chrome browser Economy in turmoil: Latest news and tips iPhone 3G Bill Gates moves on Windows Vista A to Z Mac A to Z 2008 Salary Survey Find wage data for 50 IT job titles. More Special Reports 2008 Premier 100 IT Leaders 2007 Premier 100 IT Leaders 2008 Best Places to Work in IT 2007 Best Places to Work in IT 2008 Salary Survey 2007 Salary Survey 2006 Salary Survey 2008 IT Forecast 2007 IT Forecast 40 Years of Computerworld Top 12 Green-IT Users The FAQs About Going Green IT Schools to Watch iPhone: One Year Later Global Mobile Your Next Data Center Management: Reinventing IT Stop Data Leaks Web 2.0 Security Surviving Disasters Managing Storage Virtualization The Lean Storage Machine Storage on Trial Can Web 2.0 Save BI? Bypass These BI Potholes All Zones Business Continuity Zone The File Data Management Zone Security Management Zone The SAS Zone Business Intelligence and Analytics Zone The Enterprise Search Zone Software as a Service Zone The Security Zone See your link here

Advance your BlackBerry(R) solution management know-how this July Advance your BlackBerry(R) solution management know-how this July BlackBerry Technical Seminar, register today! Go to the webcast  Cut Data Center Energy Costs Get this white paper now! (Source: Liebert) Cooling accounts for 35% of data center energy consumption. Discover strategies that can reduce cooling energy costs by as much as 40%, including simple steps you can take to get more from your existing cooling system and emerging technologies that can increase cooling capacity and data center density. Download this white paper  Computerworld Executive Briefing: Automating Network Management Download this Executive Briefing now (a $195.00 value), compliments of ProCurve Networking by HP. (Source: Computerworld) This briefing looks at the basics of network management, which tend to get lost in the dizzying array of products and processes. It also examines new tools that are on the way to help IT executives deal with management in the new era of automation.Download this Executive Briefing now (a $195.00 value), compliments of ProCurve Networking by HP. Download this executive briefing  White Papers Read up on the latest ideas and technologies from companies that sell hardware, software and services. Security Trends Overview: Targeted Phishing Attack Enterprise Findability Without the Complexity Wireless LAN Virtualization: Twice the Network at Half the Cost View more whitepapers

• BlackBerry Storm sales should be strong, Verizon says
• Review: BlackBerry's Storm is awkward and disappointing
• Microsoft to launch IE8 in '09; RC due out in Q1
• More top stories 

Accelerate your pursuit of perfection For almost 80 years, Kodak has been helping banks, insurance companies, healthcare providers, government agencies and other businesses produce billions of document images. So Kodak is uniquely positioned to know and deliver–what customers want: easy-to-use scanners that output the best possible image quality. Download this white paper now!

Steven J. Vaughan-Nichols: 64-Bit Linux Adobe Flash Player: Surprisingly good When Adobe decided it was time to provide a 64-bit Flash Player, they released it on Linux and Solaris. Wow. [more]