Feeds

Shocker DNS spoofing vuln discovered three years ago by a student

The mad woman in the attic

Top 5 reasons to deploy VMware with Tegile

A flaw in how the internet's addressing system works that sparked a patching frenzy on Tuesday night may has first been uncovered by a student as long as three years ago.

Shortcomings in how the Domain Name System protocol is implemented by multiple vendors facilitate DNS cache poisoning attacks, security clearing house US CERT warned on Tuesday. Successful exploitation of these security shortcomings creates a means for hackers to spoof DNS replies, allowing for the redirection of network traffic or to mount man-in-the-middle attacks.

Security researcher Dan Kaminsky deserves a lot of credit for realising the seriousness of the flaw and working behind the scenes with multiple vendors over recent months leading up to co-ordinate this week's patching activities. But Kaminsky may not have been the first to discover the flaw, only the first with enough clout to mobilise action.

Three years ago Ian Green, then studying for his GIAC Security Essentials Certification (GSEC), submitted a paper that details the same DNS spoofing vulnerability, the SANS Institute's Internet Storm Centre notes.

In order to spoof a DNS request it's necessary to "guess" both the Query ID and the source port. The query ID is 16 bits long, and the UDP source port also has over 60,000 potential option. But as Green noted back in January 2005, DNS transactions are incremented by one for each subsequent query while the UDP source port remains the same during a session.

Although the weaknesses of the DNS protocol have been known for some time, Kaminsky's upcoming presentation at Black Hat next month is sure to put what has been a peripheral, forgotten issue (something like the mad woman in the attic) into the full view of the public. Details of new tools designed to exploit the vulnerability or exploits already in the wild are likely to emerge. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
BlackEnergy crimeware coursing through US control systems
US CERT says three flavours of control kit are under attack
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
The hidden costs of self-signed SSL certificates
Exploring the true TCO for self-signed SSL certificates, including a side-by-side comparison of a self-signed architecture versus working with a third-party SSL vendor.