Q&A: DNS inventor Paul Mockapetris on Internet security

Computerworld - Paul Mockapetris invented the Internet's core Domain Name System (DNS), which is a highly distributed hierarchical database that translates Web names into Internet Protocol addresses, and vice versa. Without it, the Internet as it's structured today wouldn't work. In an interview this week with Computerworld, he talked about the state of the DNS a year after the first distributed denial-of-service attack on the system (see story).

Why is DNS security such a concern? There was a cybersecurity report that came out of the U.S. government that said the two biggest security issues were DNS and BGP [Border Gateway Protocol]. Part of it is that this is just the place where an attacker has the most leverage. ... If you can get to control either the traffic lights or change the street signs, you can create chaos on the road system.

Is the DNS safer than it was a year ago? The state of it all is uneven. It is more robust at the top. But the bottom layers are a little bit less safe than they were a year ago just because the attack tools have sort of gotten better. The bad guys share their attack tools, and the good guys haven't bought any new technology to beat them, except at the root server level.

DNS inventor Paul Mockapetris

What is the problem when you go down the hierarchy? If you talk to any of the top-level domains, I think they will tell you that the amount of junk and various kinds of strange packets that they see [is growing]. And there's a bunch of broken implementations such that they'll receive repeated queries and so forth. There was survey done that said a lot of the traffic to root servers is not useful, and the same thing happens for top-level domains too.

I think down at the lower levels there are sort of persistent problems that are not unlike those that you see on the Web or even e-mail [systems], where people are subject to denial-of-service attacks and the like.

What exactly is the junk traffic that you are talking about here? There was a report that said that somewhere north of 90% of the traffic to root servers wasn't really useful traffic. What I mean by that is sort of the same query repeated over and over again. I used to say I was incredibly proud of the DNS [because] it was like a finely tuned machine that actually worked with a lot of sand in the gears. And the thing that I guess [that] really surprises me is when you look at a lot of the root server traffic these days, there really is more sand than anything else. And part of the problem is who is going to do anything about it?