Brian's Brain

Jul 22 2008 1:00AM | Permalink | Email this | Comments (6) |
Blog This! using:  Blogger.com | LiveJournal |
Digg This | Slashdot This | add to Del.icio.us

This is one of those times when I really hate to have to say 'I told you so' (but of course I will anyway). Back in early 2004, I crafted one of my more popular editorials (at least as measured in number of scathing responses) based on my personal experience with hacker-surmounted gear running a no-longer-updated-by-hardware-supplier Linux distribution. Much of the feedback from the Torvalds-and-Stallman faithful was frankly ridiculous. Insisting that I should maintain the O/S and its bundled apps in the absence of Toshiba's continuance (assuming, of course, that I even know about the vulnerabilities as they emerge) might be remotely appropriate for a senior technical editor with an engineering background (and far more time on his hands than I happen to have). But advocating self-maintenance for the non-technical masses is absolutely ludicrous. I digress...

DNS, for (the likely few of) you who don't already know, is the means by which URLs like www.bdipert.com get translated into (currently) 64.202.189.170 (thank you, GoDaddy and Yahoo! GeoCities). That translation process is the bailiwick of (appropriately named) DNS servers. My current nameservers, for example, are at 68.94.156.1 and 68.94.157.1, courtesy of PPPoE and AT&T Yahoo! And back in Sacramento, I used (and will use again, whenever I get around to switching around my router's setup) OpenDNS at 208.67.222.222 and 208.67.220.220.

Plenty of folks already get fooled by so-called phishing attacks; an email purportedly from Wells Fargo Bank, for example, prompts them to click on an embedded link that leads to a website which might look an awful lot like www.wellsfargo.com (complete with login username and password text entry boxes) but isn't. Now imagine the problems that would ensue if, for example, someone manually entered www.wellsfargo.com in their web browser and, instead of getting routed to Wells Fargo's website, went to the look-alike site instead.

That scary scenario (and plenty of others like it) is the crux of the DNS protocol flaw IOActive research Dan Kaminsky stumbled across at the beginning of this year. That we're only hearing about it now via US-CERT (the U.S. Computer Emergency Readiness Team) is by design; as a result of a meeting Kaminsky and Paul Vixie called in March, more than 80 vendors (Microsoft, Cisco, the maintainers of the BIND aka Berkeley Internet Name Domain distribution that's at the heart of UNIX, Linux and OS X, etc) quietly and frantically began working on patches, which were simultaneously released on July 8^th. But, of course, until you and your peers roll in those patches, you're vulnerable.

The details of the DNS poisoning vulnerability won't be known until Kaminsky's presentation at the Black Hat Briefings on August 6^th...though predictably, they're already starting to leak. And to be clear, the patches rolled out by the 80+ vendors earlier this month don't fix the DNS flaw; it can't be fixed. Rather, if indeed the widespread belief is correct that the flaw involves insufficient randomness in the transaction ID generated by a client when querying a DNS server, the patches simply increase the randomness in order to decrease (but not eliminate, mind you) the potential for an attacker to inject forged code and spoof DNS traffic.

So what do you do, regardless of whether you're a PC manufacturer or an embedded systems developer? First off, take the issue seriously. Next, visit the DNS Checker on Kaminsky's site to see if your software is vulnerable. I just did, and apparently AT&T hasn't fixed its DNS servers yet...hmmm, maybe I'll switch to OpenDNS now. If patches exist, install them immediately. Note that both servers and clients need patching; Microsoft's client patch, for example, played havoc with ZoneAlarm firewall users until Check Point released a fix a few days later.

And if you're running an obsolete O/S for which no patch is available? Well then, as soon as Kaminsky gives his presentation early next month, you'd better hope you've got access to the source code and are either a good programmer yourself or have access to someone who is (and who is also competent from a security standpoint, and can be trusted to not install back-doors or do other malfeasance). Oh, and until you implement the fix? Yank the Ethernet cable and disable the Wi-Fi, eh?