2008 July 25 | billso.com

Fixing the DNS security hole with OpenDNS

ism

Posted Friday, 25 July 2008

News is trickling into the mainstream media about the DNS security hole that Dan Kaminsky found a while back. It’s a problem that has existed for years in the DNS software used on almost every major computing platform. With a trivial amount of CPU power, a cracker can redirect a web browser from a legitimate domain name to whatever server they wish. In some ways, it resembles a pharming attack. Details on how to perform the attack were made available this week, and there’s a brief description in a Register article called Exploit code for Kaminsky DNS bug goes wild.

The Domain Name System matches alphanumeric URLs like billso.com to their corresponding numeric IP address. If DNS is broken, the Internet is more or less broken.

Patches for these systems were released after 8 July 2008, when Kaminsky announced that the bug did indeed exist. Many server administrators haven’t installed the new DNS software yet.

According to another Register article called Worlds biggest ISPs drag their feet on critical DNS patch, the following providers haven’t performed the patch on their ISP networks:

Time Warner Cable
AT&T
British Telecom
Bell Canada
T-Mobile

I tested Hawaiian Telcom’s DSL network last night: they failed, too.

I haven’t heard whether Comcast has fixed their DNS servers, but based on the New York Times article called GComplaining Bloggers Hava a Cable Company’s Ear, I’d think Comcast would respond quickly to blogged complaints about their DNS service.

HPU’s DNS servers on the wired and WiFi networks passed the test this morning when I checked them, and I’ve received confirmation that they patched their servers earlier this week. That’s good news, since HPU’s primary ISP is Oceanic Time Warner.

You can fix the DNS hole yourself

ISPs must offer certain services as part of an Internet connection. DNS is one of these services. Many ISPs run their own DNS servers, which connect to larger servers on the backbone. Corporations usually have their own DNS servers inside their network, to help users connect to internal resources like printers, servers, and network shares.

But residential users don’t HAVE to use their ISP’s DNS in most cases. If you have your own router at home, or you just plug your computer into a cable modem or a nearby WiFi network, you can use Dan Kaminsky’s tool to see if your DNS server is vulnerable. Use the Check Your DNS button in the upper-right corner of his blog pages at doxpara.com

For those of you on a school or company’s network, please check with your IT or network staff before changing your DNS settings.

If your ISP or WiFi network is using a vulnerable DNS server, you can use a free system called OpenDNS that is probably faster and safer that what you’re already using. It takes about 5 minutes to change your computer’s or your router’s domain name settings to use the OpenDNS servers.

Make sure you have administrative rights on your computer or router. Read the OpenDNS tutorial and make the appropriate choices. Be sure to reboot or restart your computer after confirming the changes. You may find that your Internet connection seems faster. That’s a nice benefit of OpenDNS for many users.

OpenDNS also screens out phishing sites, and lets users block or restrict access to entire categories of sites and specific URLs.

Chris Pirillo of Lockergnome has been ranting about the hole for several days now, but he’s got a point. Read his article called Is Your DNS Server Safe? for his thoughts.

Updated 29 July 2008 1930 HT: Here’s an article from John Markoff of the New York Times With Security at Risk, a Push to Patch the Web . Kaminsky estimates that 41% of all DNS servers still need the patch. With Kaminsky’s presentation coming up next week at the Black Hat conference, the clock is ticking. This article by Robert Westervelt of Security News called DNS flaw handling leaves Kaminsky pleased has some good quotes from Kaminsky about the scope of the DNS hole.