DNS

Two weeks ago, renowned security researcher Dan Kaminsky released information to the security community that alluded to a major DNS flaw on the internet.  However, instead of spreading the exploit to all and sundry he instead decided to inform major DNS vendors that the flaw existed and required patched before it became common knowledge to all and exploited.

In doing so, Dan dared to became the subject of criticism from his peers.  Their mindset was that exploits should be released and be public knowledge so that fixes can be deployed and the theory reviewed by other security professionals.  Dan himself admits that he was wrong in not seeking peer review before going public; he instead chose to go public about the flaw that he identified before all systems were fully patched and announce that a fix was being deployed.  He admitted he was wrong but I can’t help but think he wasn’t – although I must credit him for falling on his own sword after the scorn of fellow security professionals.  He didn’t release the flaw to any of his online peers because he was concerned that it would be released early before all DNS servers could be patched – which is exactly what happened.

After receiving this criticism he instead opted to seek out the opinions of two other prominent security professionals.  One being Dino Dai Zovi and the other Thomas Ptacek, a security expert and Principal over at Matasano Security.  Both validated Dans claims – he was right, the DNS vulnerability is real.  Dan was due to speak at Black Hat in Las Vegas where he would release details of the vulnerability as sufficient time would have passed to allow the patching of vulnerable servers.  However, before he had the chance, someone beat him to the punch.

Halvar Flake, otherwise know as Thomas Dullien, CEO and Head of Research over at Zynamics, decided to post his own hypothesis on what the vulnerability was.  It turned out that he was almost bang on with his theory but this was then corroborated when a post by a researcher at Matasano Security corrected some of the details Halvar Flake had posted – swiftly hitting the nail on the head of any secrecy left out there about the vulnerability.  As soon as Matasano realised the blog post had been published early they removed it and a letter of apology was published from Thomas Ptacek.  He explained that the post was not supposed to have been published, apologised for the leak and praised Dan for his work in finding the exploit.

As it stands, the patches are being applied but Dan suggests that for now you use OpenDNS for your DNS services, they are expecting your traffic and their DNS servers are safe to use.

Who says IT is boring?

Ian