Feeds

Shocker DNS spoofing vuln discovered three years ago by a student

The mad woman in the attic

Securing Web Applications Made Simple and Scalable

A flaw in how the internet's addressing system works that sparked a patching frenzy on Tuesday night may has first been uncovered by a student as long as three years ago.

Shortcomings in how the Domain Name System protocol is implemented by multiple vendors facilitate DNS cache poisoning attacks, security clearing house US CERT warned on Tuesday. Successful exploitation of these security shortcomings creates a means for hackers to spoof DNS replies, allowing for the redirection of network traffic or to mount man-in-the-middle attacks.

Security researcher Dan Kaminsky deserves a lot of credit for realising the seriousness of the flaw and working behind the scenes with multiple vendors over recent months leading up to co-ordinate this week's patching activities. But Kaminsky may not have been the first to discover the flaw, only the first with enough clout to mobilise action.

Three years ago Ian Green, then studying for his GIAC Security Essentials Certification (GSEC), submitted a paper that details the same DNS spoofing vulnerability, the SANS Institute's Internet Storm Centre notes.

In order to spoof a DNS request it's necessary to "guess" both the Query ID and the source port. The query ID is 16 bits long, and the UDP source port also has over 60,000 potential option. But as Green noted back in January 2005, DNS transactions are incremented by one for each subsequent query while the UDP source port remains the same during a session.

Although the weaknesses of the DNS protocol have been known for some time, Kaminsky's upcoming presentation at Black Hat next month is sure to put what has been a peripheral, forgotten issue (something like the mad woman in the attic) into the full view of the public. Details of new tools designed to exploit the vulnerability or exploits already in the wild are likely to emerge. ®

Mobile application security vulnerability report

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.