billso.com

The latest patch for Mac OS X finally closes a major hole in the operating system’s DNS (domain name system) software. Apple’s description is in this knowledge base article (About the security content of Mac OS X v10.5.5 and Security Update 2008-006 ).

Of course, Apple is late to the party. By early July 2008, Microsoft had a Windows patch ready for distribution, and the major *NIX systems had their own patches ready. This Cnet article called Massive, coordinated DNS patch released has more information about this project, which preceded the public announcements about the flaw.

It’s sad that Dan Kaminsky’s warnings, detailed in a 24 July 2008 Cnet article called Kaminsky (finally) provides DNS flaw details, did not inspire an urgent response form Cupertino. Apple’s July 2008 patch addressed DNS server issues, but left most Mac users without a fix.

There are still other ways to redirect a computer to a bad domain name, of course. Another piece of prevention involves using OpenDNS instead of your ISP’s domain name servers. OpenDNS is free, fast, and provides spellchecking and phishing protection that is better than most PC and Mac security software.

See these articles from the New York Times (Apple Update Finally Fixes Important DNS Bug ) and ComputerWorld (Apple releases Mac OS X 10.5.5, patches nearly 70 bugs) for more details.

Related posts and pages on billso.com

• OpenDNS
• Hawaiian Telcom
• 25 July 2008: Fixing the DNS security hole
• 24 February 2008: Pakistan blocks YouTube, breaks trust
• 15 January 2008: OpenDNS update
• 3 September 2007: When users block the ads, should web sites block the users?
• 13 July 2007: Speed up your broadband connection with OpenDNS

News is trickling into the mainstream media about the DNS security hole that Dan Kaminsky found a while back. It’s a problem that has existed for years in the DNS software used on almost every major computing platform. With a trivial amount of CPU power, a cracker can redirect a web browser from a legitimate domain name to whatever server they wish. In some ways, it resembles a pharming attack. Details on how to perform the attack were made available this week, and there’s a brief description in a Register article called Exploit code for Kaminsky DNS bug goes wild.

The Domain Name System matches alphanumeric URLs like billso.com to their corresponding numeric IP address. If DNS is broken, the Internet is more or less broken.

Patches for these systems were released after 8 July 2008, when Kaminsky announced that the bug did indeed exist. Many server administrators haven’t installed the new DNS software yet.

According to another Register article called Worlds biggest ISPs drag their feet on critical DNS patch, the following providers haven’t performed the patch on their ISP networks:

• Time Warner Cable
• AT&T
• British Telecom
• Bell Canada
• T-Mobile

I tested Hawaiian Telcom’s DSL network last night: they failed, too.

I haven’t heard whether Comcast has fixed their DNS servers, but based on the New York Times article called GComplaining Bloggers Hava a Cable Company’s Ear, I’d think Comcast would respond quickly to blogged complaints about their DNS service.

HPU’s DNS servers on the wired and WiFi networks passed the test this morning when I checked them, and I’ve received confirmation that they patched their servers earlier this week. That’s good news, since HPU’s primary ISP is Oceanic Time Warner.

You can fix the DNS hole yourself

ISPs must offer certain services as part of an Internet connection. DNS is one of these services. Many ISPs run their own DNS servers, which connect to larger servers on the backbone. Corporations usually have their own DNS servers inside their network, to help users connect to internal resources like printers, servers, and network shares.

But residential users don’t HAVE to use their ISP’s DNS in most cases. If you have your own router at home, or you just plug your computer into a cable modem or a nearby WiFi network, you can use Dan Kaminsky’s tool to see if your DNS server is vulnerable. Use the Check Your DNS button in the upper-right corner of his blog pages at doxpara.com

For those of you on a school or company’s network, please check with your IT or network staff before changing your DNS settings.

If your ISP or WiFi network is using a vulnerable DNS server, you can use a free system called OpenDNS that is probably faster and safer that what you’re already using. It takes about 5 minutes to change your computer’s or your router’s domain name settings to use the OpenDNS servers.

Make sure you have administrative rights on your computer or router. Read the OpenDNS tutorial and make the appropriate choices. Be sure to reboot or restart your computer after confirming the changes. You may find that your Internet connection seems faster. That’s a nice benefit of OpenDNS for many users.

OpenDNS also screens out phishing sites, and lets users block or restrict access to entire categories of sites and specific URLs.

Chris Pirillo of Lockergnome has been ranting about the hole for several days now, but he’s got a point. Read his article called Is Your DNS Server Safe? for his thoughts.

Updated 29 July 2008 1930 HT: Here’s an article from John Markoff of the New York Times With Security at Risk, a Push to Patch the Web . Kaminsky estimates that 41% of all DNS servers still need the patch. With Kaminsky’s presentation coming up next week at the Black Hat conference, the clock is ticking. This article by Robert Westervelt of Security News called DNS flaw handling leaves Kaminsky pleased has some good quotes from Kaminsky about the scope of the DNS hole.

Related posts and pages on billso.com

• OpenDNS
• Hawaiian Telcom
• 24 February 2008: Pakistan blocks YouTube, breaks trust
• 15 January 2008: OpenDNS update
• 3 September 2007: When users block the ads, should web sites block the users?
• 13 July 2007: Speed up your broadband connection with OpenDNS

The platform wars are heating up in the mobile phone industry. It is very difficult for a mobile carrier to support several different handset operating systems. Vodaphone CEO Arun Sarin estimated that his UK-based company supports 30 or 40 different OSes, according to this MacWorld UK report. Sarin is also quited in this Business Week article.

It takes a great deal of effort to establish a computing standard. Consider Apple, which became a new entrant with its iPhone. There are about 4 million Apple iPhones available or in use now, which is a respectable number when one considers its limited availability. There are no official iPhone providers in China or Japan yet, for example.

Google won’t make or market its own mobile phone, especially now that the company has dropped out of the 700 mHz auction, as reported by Forbes. The company’s Android mobile phone platform is based upon Linux, and over 30 companies have signed on to develop and support Android hardware. Prototypes of the Google phone were shown in Frankfurt at the Mobile World Congress this week. This CNET slideshow starts with a pic of one such prototype, which appears to be running and connected to a GSM network.

Microsoft used a similar approach to develop its Windows Mobile platform for PDAs and smartphones. The company expects that 20 million Windows Mobile phones from various manufacturers will be sold in the first half of 2008. None of these phones are Microsoft-branded devices.

Symbian claims to have the top spot, with 77 million units sold in the last year. Nokia is the main manufacturer that uses the Symbian operating system, along with Sony Ericsson. The latter company has started using Windows Mobile in its high-end smartphones, however.

For more information, see my earlier articles tagged as mobile, including:

• 11 February 2008: The modular mobile phone
• 31 January 2008: Applications are coming for the iPhone
• 25 January 2008: Nokia claims 40 percent market share
• 13 January 2008: The story of the iPhone
• 11 January 2008: BlackBerry vs iPhone
• 26 November 2007: Mobile devices for US census takers
• 24 September 2007: Do you want a PC on your iPhone?
• 23 April 2007: Samsung and Microsoft further their convergence goals

The New York Times reported on 17 January 2008 that Sun is acquiring MySQL for US$1 billion. Sun will use MySQL’s technology and customer list to facilitate an entry into the US$15 billion database market.

I use MySQL to run billso.com. I am hoping that Sun will not change the company’s open source business model. Jeff Gould of Interop News asks an important question – did Sun pay too much? MySQL reported revenues of US$70 million last year. By Gould’s estimate, Sun needs to grow MySQL to US$500 million in sales revenue for this acquisition to work.

Regardless, Sun CEO Jon Schwartz claims his company is the largest OSS firm in the world. Sun now has an important piece of the LAMP stack – that’s the Linux kernel, the Apache web server, MySQL and the Perl, Python and PHP programming languages. This InfoWorld article has some additional background on the acquisition, and why LAMP is a very important piece of the Web, e-commerce and enterprise information systems.

See my article from 25 October 2007 for information about MySQL’s software development pact with Google.

From one of my students comes a link to this article about Asustek, also known as ASUS. Here’s a November 2007 article from Forbes with some more details.

The company’s US$299 Eee PC laptop runs Linux on an Intel processor, and ships with OpenOffice and Firefox preinstalled. The price is less expensive than a copy of Microsoft Windows Vista, and was enough to scare Microsoft into a special deal: Eee PC buyers could add Microsoft Windows for US$40.

While the XO project and other spinoffs try to bring their low-cost laptops to the US mass market, Asustek is moving aggressively.