Feeds

Experts argue over whether shallow DNS gene pool hurts web infrastructure

Similar code base puts kissing cousins in a BIND

Protecting against web application threats using SSL

Experts are split over whether a lack of 'genetic diversity' in the (Domain Name System) DNS infrastructure is leaving the internet at greater risk of attacks.

Four in five (80 per cent) of the world's internet-facing DNS servers are essentially genetically identical, according to Domain Name System vendor Secure64.

In the natural world, such a limited gene pool would leave a species vulnerable to a single disease, as most graphically illustrated by the potato blight that hit crops throughout Europe during the 1840s. Lack of diversity in DNS technology could be similarly bad news because a single successful attack could theoretically take down a massive portion of global DNS infrastructure.

Most of the world’s DNS servers rely on the same DNS code base (BIND, Berkeley Internet Name Domain), creating the potential for a global internet wobble in the event of a sophisticated attack or virus. And more than a dozen major vulnerabilities have been reported in BIND DNS software, which underpins much of the web's DNS tech from multiple vendors.

'You don't hear about them, but exploits do occur'

Secure64 was unable to cite a clear example of a critical security bug in BIND that might be an agent in the doomsday scenario it presents. the firm nonetheless maintains that the risk from a lack of diversity in DNS systems is all too real.

"Most exploits are never reported in the media for obvious reasons, but DNS experts know that these exploits do occur," Mark Beckett, VP of marketing at Secure64, explained. "This is why most operators of large DNS networks are very concerned about patching security vulnerabilities very quickly, as they don’t want to risk loss of service availability for their users or customers."

Beckett was able to cite a couple of examples of exploits (here and here) but whether these attacks are severe enough to be categorised as super-critical is debatable.

Greater diversity at the hardware, operating system and application layers would contribute greater resistance against DNS attacks or at least offer a fallback system when servers need to be patched, according to Secure64.

"Any software product can have vulnerabilities, but BIND is an especially attractive target because it is so widely deployed," argues Dr Bill Worley, CTO of Secure64 and a former chief scientist at HP. "When a company’s DNS infrastructure is entirely dependent on one technology, that’s an obvious risk. That is why genetic diversity is so important for DNS infrastructure."

"Organisations that exclusively use BIND-based commercial DNS products are forced to spend unplanned time upgrading software on their DNS infrastructure or risk exposing their DNS service to attack and disruption. This endless cycle of patching increases both risk and operational costs. Genetic diversity at the hardware, operating system and application layers protects customers against vulnerabilities that affect other DNS variants."

Overstating the risks to drum up biz? Who us?

However other DNS experts, while agreeing that diversity was important on the wider scale, said that Secure64 was overstating the case for businesses to switch to a two supplier approach while ignoring some of the practical problems involved in maintaining a relationship with two or more suppliers.

Cricket Liu, vice president of architecture at DNS appliance firm Infoblox, explained: "I tend to agree with the general premise that 'genetic diversity' is important.  But the idea that over 80 per cent of the world's DNS servers are essentially genetically identical isn't accurate.  The population of Microsoft DNS Servers is just enormous, though they tend to be used internally."

"The requirement for genetic diversity is a systemic requirement, not a requirement of any single organisation's DNS infrastructure. Yes, we want the root name servers to exhibit such diversity (and they do by running a mix of implementations), but there's a very high price to an organisation to running multiple code bases: the need for additional, specialised expertise; the danger that the overall quality of administration degrades; the need to manage multiple vendor relationships; the danger of interoperability issues and inconsistent feature support."

Secure64's Beckett conceded that Liu had raised a valid point. "It is harder to manage multiple software products than a single one, so most organisations don’t do it," Beckett told El REg. "But some larger organisations are starting to adopt a DNS diversity strategy, despite its extra overhead, in order to mitigate the risk of a software failure in a single component.

"We suggest that what is good for the internet (genetic diversity of DNS) can also be good for an individual organisation," he added.

Secure64 markets DNS servers based on NSD (Name Server Daemon) and not BIND. Beckett denied suggestions that its warning about genetic diversity was either a disguised sales pitch or an example of mud-slinging against BIND.

This is not a commercial versus open source argument, nor is it a 'my product is better than yours' argument. It is simply a security best practice to bolster your resistance to potential failures in one piece of software by deploying at least one other completely different implementation in your network. So you could diversify your authoritative name servers by deploying both BIND and NSD, for example (in fact, this is exactly the strategy deployed by the root servers and many of the large top level domains) so that a bug in one implementation is unlikely to affect the other. Or you could deploy a commercial resolver like Secure64 DNS Cache with BIND or djbdns and you would bolster your resolving infrastructure in the same way.

"You just have to make sure that you deploy two 'genetically different' implementations. Deploying BIND with a commercial, BIND-based appliance does not provide you with the desired diversity, for example," Beckett concluded. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.