Feeds

Kaminsky calls for DNSSEC deployment

Political hot potato

Top 5 reasons to deploy VMware with Tegile

ARLINGTON, VA. -- Dan Kaminsky's second act has begun: Pushing the adoption of the DNSSEC security standard for the domain-name system.

So many security frameworks — from password resets via e-mail to SSL certificates — rely on DNS in some way that the protocol has to be secured for Internet security to work, Kaminsky told attendees at the Black Hat DC Security Briefings. DNSSEC is by far the leading security standard for the domain-name system, and the US government has already committed to deploying the protocol this year.

However, DNSSEC is hard to deploy and maintain and is a political hot potato, because in the simplest case, a single root — administered by the U.S. Department of Commerce — would authenticate the entire domain-name system for the Internet, Kaminsky said. Yet, other countries can maintain their own root servers for their domains, and as long as the servers are maintained, the DNS system will continue to work, he said.

"Politics is getting in our way more than security," Kaminsky said. "It's time to sign the root and be done with it."

Last July, Kaminsky and a number of Internet infrastructure companies announced that he had discovered a significant attack on the domain-name system. The companies issued patches for their products, but within three weeks, online attackers had already started using the flaw to attack some popular domains. Many DNS servers remain unpatched, he said.

Kaminsky, who is the director of penetration testing for security firm IOActive, has taken two months leave from his work to advocate DNSSEC adoption, he told SecurityFocus.

The researcher also argued for simple implementations of DNSSEC. While the protocol is fine, DNSSEC systems are not easy to deploy or maintain. Without automation, administrators will keep putting off deployments, he stressed.

This article originally appeared in SecurityFocus.

Copyright © 2008, SecurityFocus

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.