Feeds

Kaminsky calls for DNSSEC deployment

Political hot potato

The essential guide to IT transformation

ARLINGTON, VA. -- Dan Kaminsky's second act has begun: Pushing the adoption of the DNSSEC security standard for the domain-name system.

So many security frameworks — from password resets via e-mail to SSL certificates — rely on DNS in some way that the protocol has to be secured for Internet security to work, Kaminsky told attendees at the Black Hat DC Security Briefings. DNSSEC is by far the leading security standard for the domain-name system, and the US government has already committed to deploying the protocol this year.

However, DNSSEC is hard to deploy and maintain and is a political hot potato, because in the simplest case, a single root — administered by the U.S. Department of Commerce — would authenticate the entire domain-name system for the Internet, Kaminsky said. Yet, other countries can maintain their own root servers for their domains, and as long as the servers are maintained, the DNS system will continue to work, he said.

"Politics is getting in our way more than security," Kaminsky said. "It's time to sign the root and be done with it."

Last July, Kaminsky and a number of Internet infrastructure companies announced that he had discovered a significant attack on the domain-name system. The companies issued patches for their products, but within three weeks, online attackers had already started using the flaw to attack some popular domains. Many DNS servers remain unpatched, he said.

Kaminsky, who is the director of penetration testing for security firm IOActive, has taken two months leave from his work to advocate DNSSEC adoption, he told SecurityFocus.

The researcher also argued for simple implementations of DNSSEC. While the protocol is fine, DNSSEC systems are not easy to deploy or maintain. Without automation, administrators will keep putting off deployments, he stressed.

This article originally appeared in SecurityFocus.

Copyright © 2008, SecurityFocus

Next gen security for virtualised datacentres

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up Big Data
Solving backup challenges and “protect everything from everywhere,” as we move into the era of big data management and the adoption of BYOD.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?