Guru3D.com
  • HOME
  • NEWS
    • Channels
    • Archive
  • DOWNLOADS
    • New Downloads
    • Categories
    • Archive
  • GAME REVIEWS
  • ARTICLES
    • Rig of the Month
    • Join ROTM
    • PC Buyers Guide
    • Guru3D VGA Charts
    • Editorials
    • Dated content
  • HARDWARE REVIEWS
    • Videocards
    • Processors
    • Audio
    • Motherboards
    • Memory and Flash
    • SSD Storage
    • Chassis
    • Media Players
    • Power Supply
    • Laptop and Mobile
    • Smartphone
    • Networking
    • Keyboard Mouse
    • Cooling
    • Search articles
    • Knowledgebase
    • More Categories
  • FORUMS
  • NEWSLETTER
  • CONTACT

New Reviews
Corsair H170i Elite Capellix XT review
Forspoken: PC performance graphics benchmarks
ASRock Z790 Taichi review
The Callisto Protocol: PC graphics benchmarks
G.Skill TridentZ 5 RGB 6800 MHz CL34 DDR5 review
Be Quiet! Dark Power 13 - 1000W PSU Review
Palit GeForce RTX 4080 GamingPRO OC review
Core i9 13900K DDR5 7200 MHz (+memory scaling) review
Seasonic Prime Titanium TX-1300 (1300W PSU) review
F1 2022: PC graphics performance benchmark review

New Downloads
FurMark Download v1.33.0.0
Intel ARC graphics Driver Download Version: 31.0.101.4091
Corsair Utility Engine Download (iCUE) Download v4.33.138
CPU-Z download v2.04
AMD Radeon Software Adrenalin 23.1.2 (RX 7900) download
GeForce 528.24 WHQL driver download
Display Driver Uninstaller Download version 18.0.6.0
Download Intel network driver package 27.8
ReShade download v5.6.0
Media Player Classic - Home Cinema v2.0.0 Download


New Forum Topics
Forspoken Benchmark Test & Performance Analysis Review AMD Software: Adrenalin Edition 22.11.2 - Driver download and discussion Extreme 4-Way Sli Tuning Grab for free: Dishonored: Death of the Outider at Epic Games Store AMD Ryzen 7 7700X sees price drop to $299 Ambient Occlusion doesn't work on my laptop RDNA2 RX6000 Series Owners Thread, Tests, Mods, BIOS & Tweaks ! GeForce NVIDIA RTX 6000 with fully active AD102  Does Not Beat RTX 4090  in 3DMark NVIDIA GeForce 528.24 WHQL driver download & Discussion Interrupt affinity policies, latency spikes and weird behaviour




Guru3D.com » News » Details of major Internet flaw posted by accident

Details of major Internet flaw posted by accident

by Panagiotis Georgiadis on: 07/22/2008 11:33 PM | source: | 0 comment(s)
 A computer security company on Monday inadvertently published details of a major flaw in the Internet's DNS several weeks before they were due to be disclosed

The flaw was discovered several months ago by IOActive researcher Dan Kaminsky, who worked through the early part of this year with Internet software vendors such as Microsoft, Cisco, and the Internet Systems Consortium to patch the issue.

The companies released a fix for the bug two weeks ago and encouraged corporate users and Internet service providers to patch their DNS systems as soon as possible. Although the problem could affect some home users, it is not considered to be a major issue for consumers, according to Kaminsky.

At the time he announced the flaw, Kaminsky asked members of the security research community to hold off on public speculation about its precise nature in order to give users time to patch their systems. Kaminsky had planned to disclose details of the flaw during a presentation at the Black Hat security conference set for Aug. 6.

Some researchers took the request as a personal challenge to find the flaw before Kaminsky's talk. Others complained at being kept in the dark about the technical details of his finding.

On Monday, Zynamics.com CEO Thomas Dullien (who uses the hacker name Halvar Flake) took a guess at the bug, admitting that he knew very little about DNS.

His findings were quickly confirmed by Matasano Security, a vendor that had been briefed on the issue.

"The cat is out of the bag. Yes, Halvar Flake figured out the flaw Dan Kaminsky will announce at Black Hat," Matasano said in a blog posting that was removed within five minutes of its 1:30 p.m. Eastern publication. Copies of the post were soon circulating on the Internet, one of which was viewed by IDG News Service.

Matasano's post discusses the technical details of the bug, saying that by using a fast Internet connection, an attacker could launch what's known as a DNS cache poisoning attack against a Domain Name Server and succeed, for example, in redirecting traffic to malicious Web sites within about 10 seconds.

Matasano Researcher Thomas Ptacek declined to comment on whether or not Flake had actually figured out the flaw, but in a telephone interview he said the item had been "accidentally posted too soon." Ptacek was one of the few security researchers who had been given a detailed briefing on the bug and had agreed not to comment on it before details were made public.

Matasano's post inadvertently confirmed that Flake had described the flaw correctly, Ptacek admitted.

Late Monday, Ptacek apologized to Kaminsky on his company blog. "We regret that it ran," he wrote. "We removed it from the blog as soon as we saw it. Unfortunately, it takes only seconds for Internet publications to spread."

Kaminsky's attack takes advantage of several known DNS bugs, combining them in a novel way, said Cricket Liu vice president of architecture with DNS appliance vendor Infoblox, after viewing the Matasano post.

The bug has to do with the way DNS clients and servers obtain information from other DNS servers on the Internet. When the DNS software does not know the numerical IP address of a computer, it asks another DNS server for this information. With cache poisoning, the attacker tricks the DNS software into believing that legitimate domains, such as idg.com, map to malicious IP addresses.

In Kaminsky's attack a cache poisoning attempt also includes what is known as "Additional Resource Record" data. By adding this data, the attack becomes much more powerful, security experts say. "The combination of them is pretty bad," Liu said.

An attacker could launch such an attack against an ISP's domain name servers and then redirect them to malicious servers. By poisoning the domain name record for www.citibank.com, for example, the attackers could redirect the ISP's users to a malicious phishing server every time they tried to visit the banking site with their Web browser.

Kaminsky declined to confirm that Flake had discovered his issue, but in a posting to his Web site Monday he wrote "13>0," apparently a comment that the 13 days administrators have had to patch his flaw before its public disclosure is better than nothing.

"Patch. Today. Now. Yes, stay late," he wrote.

He has posted a test on his Web site that anyone can run to find out if their network's DNS software is patched.







« Help us find a better way to pronounce www · Details of major Internet flaw posted by accident · Microsoft preps online game distribution service »

Related Stories

Sony Reveals Details Customer Appreciation Program - 05/17/2011 10:15 AM
Sony today released details on the Customer Appreciation Program it will roll out to all PSN users. This package will be made available to all existing registered PlayStation Network and Qriocity use...

Intel Cedar Trail Atom details surface - 05/03/2011 09:09 AM
AnandTech published details about Intel's upcoming "Cedar Trail" Atom processors, you can check it out over here. The core architecture remains unchanged, so CPU performance should be the sa...

AMD details new Bobcat and Bulldozer core designs - 08/25/2010 11:00 AM
AMD

DDR4 memory details surface - 08/17/2010 10:49 AM
Memory makers discosed some of the first technicalities on DDR4 at the MemCon conference in Tokyo. This new memory standard is expected to be introduced in 2012, with broad availability expected by 20...

Intel reveals details of 32-cores Knights Ferry MIC - 08/09/2010 10:39 AM
The colleagues over at X-bit Labs report Intel has unveiled specifications of Knights Ferry, a many Intel cores (MIC) accelerator for servers. The Knights Ferry has 32 x86 cores clocked at 1.2GHz and ...



Guru3D.com © 2023