DNS vulnerability update: Patch now!

The stakes have increased in the cat-and-mouse game between
hackers and information technology administrators who are trying to
patch Domain Name System (DNS) servers for a recently announced
vulnerability.

The security blog for Matasano mistakenly published some of the
details of the DNS vulnerability July 21, creating the possibility
that exploits could soon be developed. Although the entry was
quickly removed, the information had already been disseminated,
making it even more critical that vulnerable servers be patched
right away.

Dan Kaminsky, director of penetration testing at IOActive Inc.,
discovered the vulnerability about six months ago, but because of
its seriousness, it was kept under tight wraps until the DNS vendor
community could develop patches. The vulnerability was announced
July 8 as part of an unprecedented multivendor patch release.

Details of the vulnerability were to be withheld until Kaminsky
released them Aug. 6 at the Black Hat Briefings security conference
in Las Vegas. The delay would give administrators 30 days to get
critical patches installed.

“Reverse engineering is not impossible,” Kaminsky
said during the initial announcement. “But we hope it will
not be done quickly. Things are well under control. We have bought
you as much time as possible.”

But that time was cut in half with Monday’s exposure.

“We dropped the ball here,” wrote Thomas Ptacek, a
principal at Matasano, in an online apology.

Kaminsky responded eloquently to the exposure in his own
blog later in the day: “Patch. Today. Now. Yes, stay
late.”

DNS is a hierarchical system that translates written names, such
as URLs and e-mail addresses, into IP addresses. That function
makes it crucial to almost all uses of the Internet. According to
the U.S. Computer Emergency Readiness Team, the vulnerability could
allow cache poisoning and misdirection of Web requests, sending
users to unknown and possibly malicious Web sites. Cache poisoning
is not a new threat, but because the recently discovered
vulnerability is in the basic design of DNS, it is found in nearly
all implementations of the protocols, making it more serious than
many previous problems.

If the vulnerability were exploited, “you would have the
Internet, but it wouldn’t be the Internet you expect,”
Kaminsky said.

The exposure of the vulnerability’s details happened when
a security researcher posted a speculation about it in his
blog.

“Shortly afterward, when the story began getting traction,
a post appeared on our blog about that hypothesis,” verifying
it, Ptacek wrote in his explanation. “It was posted in error.
We regret that it ran. We removed it from the blog as soon as we
saw it. Unfortunately, it takes only seconds for Internet
publications to spread.”

Ptacek said he had known the details of Kaminsky’s
findings and was holding them until next month’s scheduled
release.

“We chose to have a story locked and loaded for that
presentation or for any other confirmed public disclosure,”
he wrote. That was the story that was posted on the blog. “On
a personal level, I regret this as well.”

Ptacek emphasized the importance of getting patches installed
quickly. “This is a serious problem, it merits immediate
attention, and the extra attention it’s receiving today may
increase the threat,” he wrote. “The Internet needs to
patch this problem ASAP.”

Patching is not necessarily a simple matter. Name servers have
to be located and the versions and status of their software
confirmed before they can be fixed, and administrators need to test
patches before installing them to ensure that they do not create
additional problems. Some problems have been reported with patches
released by Microsoft, for example.

“It is very important to get DNS patched correctly,”
Kaminsky said. “If you screw up the deployment of a fix, a
lot of people get a sudden outage.”

In some cases, more than patching will be required. The patches
that have been released add randomization to transaction IDs used
to authenticate queries to name servers, using a random source port
ID. Firewalls that limit the number of ports that can be used might
have to be reconfigured to allow the higher level of
randomization.

In addition, many servers are running older versions of the
Berkeley Internet Name Domain (BIND) server, which is probably the
most commonly used DNS software. The latest version is BIND 9. BIND
8 no longer is supported, but about 6 percent of servers scanned in
a recent global survey were still running it. Those servers will
have to update to Version 9.

For those who do not have time to update their servers and for
organizations with Internet service providers that have not patched
their servers, OpenDNS will accept forwarded queries. OpenDNS is a
free DNS resolution service for homes and business, with two
recursive name server addresses for public use that provide an
alternative to using an ISP’s servers. Its servers are
patched, and it has agreed to accept traffic from other
organizations.

“Yes, forward to OpenDNS if you have to,” Kaminsky
said. “They’re ready for your traffic.”

Speculation continues as to what the ultimate systemic Domain Name System (DNS) flaw could be. This flaw apparently allows Web surfers to be spoofed, directing them to fake Web sites to gain passwords and load malware on their computers.

The flaw was first revealed by Dan Kaminsky, a researcher at security firm IOActive Inc., although Kaminsky largely withheld the technical details of the exploit.

In a Friday morning press conference, Kaminsky said that many of the patches released by various IT vendors and security firms reacting to his bug discovery (reported by CNet News.com) are at best temporary fixes to a more pervasive problem. Kaminsky added that he would be disclosing further findings at the Black Hat security conference in Las Vegas next month.

Kaminski argued that there should be a blackout date on discourse and research about the vulnerability until then. In contrast, IT security gadfly Halvar Flake, who is also CEO and head of research at Sabre Security, outlined a hypothesis for the DNS flaw in his blog and disagreed with the blackout.

"Let's assume that the DNS problem is sufficiently complicated that an average person that has some background in security, but little idea of protocols or DNS, would take N days to figure out what is problem is. So clearly, the assumption behind the 'discussion blackout' is that no evil person will figure it out before the end of the N days [blackout]," Flake wrote.

Flake's proposed method of finding the vulnerability came about when he ran tests that involved sending spoofed protocol transfer requests to a nameserver, a gate-keeping function for IP language, which converts text domain names into numeric IP addresses. Through this process, an attacker sets up a Web page with tags that are routed to a corrupt nameserver. When a user visits that Web page, the browser may be fooled into associating a legitimate name server with the page.

The DNS vector should be considered a pervasive threat to enterprise systems.

The U.S. Computer Emergency Readiness Team, about two weeks ago -- around the time of Kaminsky's initial announcement -- issued an advisory describing the issue. It listed more than 80 vendors whose products are affected by the vulnerability, including names like Microsoft, Cisco Systems, Sun Microsystems Inc. and Red Hat, among others.

Having a reliable DNS cache exploit in place increases the probability that a hacker can redirect an unsuspecting Web surfer to a malicious Web site, an attack called "phishing."

"Phishing attacks were already on the rise against the increasing number of hosted enterprises services," said Andrew Storms, director of security at San Francisco-based IT security firm nCircle. "I don't think we've seen the last of these problems. The temporary solutions are to immediately patch your system in the meantime because the risk to corporate networks is one of the more serious risks enterprises face."