Researcher's hypothesis may expose uber-secret DNS flaw
Responsible disclosure debate rages on
Two weeks ago, when security researcher Dan Kaminsky announced a devastating flaw in the internet's address lookup system, he took the unusual step of admonishing his peers not to publicly speculate on the specifics. The concern, he said, was that online discussions about how the vulnerability worked could teach black hat hackers how to exploit it before overlords of the domain name system had a chance to fix it.
That hasn't stopped researcher Halvar Flake from posting a hypothesis that several researchers say is highly plausible. It describes a simple method for tampering with DNS name servers that get queried when a user tries to visit a specific website. As a result, attackers would redirect someone trying to visit a site such as bankofamerica.com to an impostor site that steals their credentials.
The recipe calls for the attacker to flood a DNS server with multiple requests for domain names, for instance www.ulam00001.com, www.ulam00002.com and so on. Since the name server hasn't seen these requests before, it queries a root server for the name server that handles lookups for domains ending in .com. The attacker then uses the information to send fraudulent lookup information to the DNS server and make it appear as if it came from the authoritative .com name server. With enough requests, eventually one of the spoofed requests will match and the IP address for a requested domain will be falsified.
In an email to El Reg, Kaminsky declined to confirm whether Flake's speculation is correct. We're hoping it is, because if it isn't, it means the net's DNS is vulnerable to a second flaw that, like Kaminsky's, could result in major security breaches for an untold number of users.
"It's very plausible; I think he's nailed it," Nate Lawson, principal of Root Labs, said of Flake's hypothesis. "If that is the case, it definitely goes against Dan's request that people not speculate."
It would also demonstrate the difficulty researchers like Kaminsky face in trying to keep the specifics of a vulnerability quiet. While Flake is highly respected in security circles, he admits his knowledge of DNS is limited. He had to spend time reading a "DNS-for-dummies" text to get up to speed.
If a few weeks was enough for him to come up with an attack scenario, plenty of less scrupulous hackers almost certainly will be able to do the same thing, calling into question whether it's realistic to limit vulnerability disclosure in the way Kaminsky has proposed.
"It's the universal opinion of the research community that it's not a reasonable request," said Thomas Ptacek, a researcher at Matasano who is critical of the admonition against other researchers publicly discussing the flaw. Ptacek and several other researchers have received a briefing from Kaminsky in exchange for a promise not to discuss it publicly, a condition he says is perfectly OK.
But Ptacek bristles at calls that others who have not been briefed should be pressured to keep quiet.
"The cabal approach does not work," he said.
Kaminsky has said he won't provide a detailed discussion of the DNS flaw until he speaks early next month at the Black Hat conference in Las Vegas. Critics say the move has more to do with artificially generating buzz than following responsible disclosure guidelines.
Kaminsky and his supporters disagree, saying it takes time for those maintaining DNS servers to deploy patches and detailed discussions in the meantime could allow attackers to exploit the flaw.
"The vast majority of people are choosing not to publicly speculate, and I appreciate that," Kaminsky wrote in an email. "A few aren't, as is their right. Thus far, everyone who's found the bug has been gracious enough to me to let me present the research on August 6th. But I don't know how long that will last. People need to patch this, sooner rather than later." ®