Feeds

Experts argue over whether shallow DNS gene pool hurts web infrastructure

Similar code base puts kissing cousins in a BIND

SANS - Survey on application security programs

Experts are split over whether a lack of 'genetic diversity' in the (Domain Name System) DNS infrastructure is leaving the internet at greater risk of attacks.

Four in five (80 per cent) of the world's internet-facing DNS servers are essentially genetically identical, according to Domain Name System vendor Secure64.

In the natural world, such a limited gene pool would leave a species vulnerable to a single disease, as most graphically illustrated by the potato blight that hit crops throughout Europe during the 1840s. Lack of diversity in DNS technology could be similarly bad news because a single successful attack could theoretically take down a massive portion of global DNS infrastructure.

Most of the world’s DNS servers rely on the same DNS code base (BIND, Berkeley Internet Name Domain), creating the potential for a global internet wobble in the event of a sophisticated attack or virus. And more than a dozen major vulnerabilities have been reported in BIND DNS software, which underpins much of the web's DNS tech from multiple vendors.

'You don't hear about them, but exploits do occur'

Secure64 was unable to cite a clear example of a critical security bug in BIND that might be an agent in the doomsday scenario it presents. the firm nonetheless maintains that the risk from a lack of diversity in DNS systems is all too real.

"Most exploits are never reported in the media for obvious reasons, but DNS experts know that these exploits do occur," Mark Beckett, VP of marketing at Secure64, explained. "This is why most operators of large DNS networks are very concerned about patching security vulnerabilities very quickly, as they don’t want to risk loss of service availability for their users or customers."

Beckett was able to cite a couple of examples of exploits (here and here) but whether these attacks are severe enough to be categorised as super-critical is debatable.

Greater diversity at the hardware, operating system and application layers would contribute greater resistance against DNS attacks or at least offer a fallback system when servers need to be patched, according to Secure64.

"Any software product can have vulnerabilities, but BIND is an especially attractive target because it is so widely deployed," argues Dr Bill Worley, CTO of Secure64 and a former chief scientist at HP. "When a company’s DNS infrastructure is entirely dependent on one technology, that’s an obvious risk. That is why genetic diversity is so important for DNS infrastructure."

"Organisations that exclusively use BIND-based commercial DNS products are forced to spend unplanned time upgrading software on their DNS infrastructure or risk exposing their DNS service to attack and disruption. This endless cycle of patching increases both risk and operational costs. Genetic diversity at the hardware, operating system and application layers protects customers against vulnerabilities that affect other DNS variants."

Overstating the risks to drum up biz? Who us?

However other DNS experts, while agreeing that diversity was important on the wider scale, said that Secure64 was overstating the case for businesses to switch to a two supplier approach while ignoring some of the practical problems involved in maintaining a relationship with two or more suppliers.

Cricket Liu, vice president of architecture at DNS appliance firm Infoblox, explained: "I tend to agree with the general premise that 'genetic diversity' is important.  But the idea that over 80 per cent of the world's DNS servers are essentially genetically identical isn't accurate.  The population of Microsoft DNS Servers is just enormous, though they tend to be used internally."

"The requirement for genetic diversity is a systemic requirement, not a requirement of any single organisation's DNS infrastructure. Yes, we want the root name servers to exhibit such diversity (and they do by running a mix of implementations), but there's a very high price to an organisation to running multiple code bases: the need for additional, specialised expertise; the danger that the overall quality of administration degrades; the need to manage multiple vendor relationships; the danger of interoperability issues and inconsistent feature support."

Secure64's Beckett conceded that Liu had raised a valid point. "It is harder to manage multiple software products than a single one, so most organisations don’t do it," Beckett told El REg. "But some larger organisations are starting to adopt a DNS diversity strategy, despite its extra overhead, in order to mitigate the risk of a software failure in a single component.

"We suggest that what is good for the internet (genetic diversity of DNS) can also be good for an individual organisation," he added.

Secure64 markets DNS servers based on NSD (Name Server Daemon) and not BIND. Beckett denied suggestions that its warning about genetic diversity was either a disguised sales pitch or an example of mud-slinging against BIND.

This is not a commercial versus open source argument, nor is it a 'my product is better than yours' argument. It is simply a security best practice to bolster your resistance to potential failures in one piece of software by deploying at least one other completely different implementation in your network. So you could diversify your authoritative name servers by deploying both BIND and NSD, for example (in fact, this is exactly the strategy deployed by the root servers and many of the large top level domains) so that a bug in one implementation is unlikely to affect the other. Or you could deploy a commercial resolver like Secure64 DNS Cache with BIND or djbdns and you would bolster your resolving infrastructure in the same way.

"You just have to make sure that you deploy two 'genetically different' implementations. Deploying BIND with a commercial, BIND-based appliance does not provide you with the desired diversity, for example," Beckett concluded. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.