Brian's Brain

Consider me disappointed, but not necessarily surprised. As I mentioned two weeks ago, Apple's OS X (by virtue of its BSD Unix heritage) employs BIND as its DNS server (and client) code base. In spite of being briefed (along with other BIND implementers) by Dan Kaminsky and his peers early this year on the now-being-exploited DNS poisoning vulnerability, and in spite of being told of the coordinated patch roll-out plan scheduled for July 8^th...it took Apple until August 1^st to release patches for the server versions of OS 10.4 and OS 10.5 (but not OS 10.3, whose users have yet to receive a formal end-of-life notification from the company). And, believe it or not, the client-side variants of the various OS X versions (including, presumably, the flavors that run inside the iPhone and iPod touch) are (as I write these words on the morning of August 6^th) still vulnerable to DNS spoofing. Yes, Apple fanboys, Microsoft patched Windows weeks ago.

If you're an OS X user, therefore, pay particular attention to this post. But more generally, any of you using Internet-centric devices in a mobile manner that involves connection to random DNS servers should pay attention, too. While O/S vendors can (and in most cases, by now have) rolled out their patches, it's up to their customers to install them. And again, not surprisingly, IT administrators are being irresponsibly slow at tackling this critical task. So, since for the foreseeable future you can't be absolutely certain that your ISP-of-the-moment's preferred DNS servers are safe, I recommend you follow the advice offered by Larry M in the comments section of my day-later follow-up post; override the default DHCP-assigned DNS server assignments with hard-coded references to OpenDNS (208.67.222.222 and 208.67.220.220).

To be clear; if you've already verified that your home and office ISPs are patched, then you don't need to do the override for, say, a web browser-inclusive game console that's never going to leave the premises. But portable gizmos such as laptop computers, cell phones and Internet tablets are prime DNS workaround candidates. Larry M's instructions were Windows-specific, but every piece of equipment I've examined in the last few weeks since first hearing of the spoof vulnerability supports (in one way or another) hard-coded DNS server assignments in conjunction with DHCP connections. And specifically regarding cell phones, once you've confirmed that your primary service provider has implemented the patch, you probably only need to worry if you're on a roaming cellular data tether or if you're using a phone that also embeds a Wi-Fi transceiver.