Ads by TechWords

See your link here
Receive the latest technology news and information.
IT Management
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Opinion: Fix your flawed DNS ... NOW!

July 14, 2008 12:00 PM ET

Computerworld - This installment of "Frankly Speaking" originally appeared in Computerworld's print edition.

If you're a hard-core IT security wonk, you already know about this. If not, go to Doxpara.com right now and click on the button that says "Check my DNS." That will run a simple test to tell you whether your name server appears to be vulnerable to DNS cache poisoning.

No, really -- right away. Doxpara.com. Go. Now. We'll wait.

Did the test say that you're vulnerable? Then you've got work to do.

Did it say that you're not? You've still got work to do.

Here's why: Early this year, security researcher Dan Kaminsky discovered a design flaw in the Internet's Domain Name System, which translates names like Computerworld.com into IP addresses such as 65.221.110.98.

Kaminsky didn't find a bug in one DNS implementation. He found a vulnerability that's designed into every DNS server. That's right -- they're all broken. Microsoft's version. And Cisco's. And BIND, which is widely used on Unix and Linux servers.

The design flaw allows an attacker to hijack domain names. Put simply, a victim would never know where the Internet was taking him. E-mail could be redirected. Web sites could be spoofed. Everything on the Internet is at risk if an attacker takes over the DNS.

How do you fix a fundamental design flaw that affects the entire Internet? Answer: You can't. So you don't. Instead, you find a way to make the design flaw much, much harder to exploit.

Kaminsky contacted Paul Vixie, who has been responsible for the BIND DNS server since 1988. Vixie called together the top DNS experts. In March, they secretly started work on the job of patching every major DNS implementation. Not with a fix -- that would be impossible -- but with a work-around.

On July 8, they all rolled out their patches at the same time. Microsoft. Cisco. AT&T. Sun. Red Hat. The BIND guys. Everybody.

This is not "a patch" to fix "a bug." This is a wake-up call for virtually the whole IT industry. The entire Internet needs fixing. Yes, right now. And that includes every corporate network and every ISP.

Here's the good news: Because the flaw Kaminsky discovered is so baked into DNS, because it literally can't be fixed, the only good way to block it is to make it really hard for attackers to do anything bad to a DNS server. That's what last week's patches do.

As a result, those patches protect you not only from the design flaw Kaminsky discovered, but also from lots of other bugs that have been found over the years -- and from bugs that haven't yet been discovered. It's the biggest and most effective Internet security fix ever.



Jump to comments

frank hayes

Additional Resources

EFD vs. HDD - What You Need to Know
WHITE PAPER
Enterprise flash drives provide a new Tier 0 storage layer capable of delivering high I/O performance at a very low latency. Proper use of EFDs in an Oracle environment can deliver increased performance compared to fibre channel drives. Read the recommendations for identification of the best DB components for EFDs.
Gartner Research Report: Magic Quadrant for Application Delivery Controllers, 2009
WHITE PAPER
The market for products to improve the delivery of application software over networks remains dynamic and innovative. Vendors focused on solving enterprises' most-pressing application problems have become the top players.
Eight Criteria for Server Load Balancing
WHITE PAPER
Server load balancers are a simple yet highly effective means to scale an application environment while ensuring its availability. Today's solutions should also address application performance and security. Read about the top eight criteria you should consider when choosing a server load balancer and how Citrix NetScaler meets those requirements.

What People Are Saying

White Papers & Webcasts

The Workday User Experience Video
Watch Workday's Creative Director, Scott Lietzke, discuss the business-centered design philosophy at Workday.

Business Process Framework Demo
Learn about Configurable Business Processes and Calculated Fields. Watch Now!

Manager Experience Demo
Go beyond self-service solutions to perform more effectively. Watch Now.

Faster, Cheaper and Easier to Maintain
Can you afford not to upgrade your servers to today's advanced, energy-efficient technologies?  


IT Jobs