There has been some speculation and even backlash on the internet about the recent DNS vulnerability, I posted about it here. Interestingly some people are saying that the vulnerability should have been disclosed when discovered.
This is plain silly. To put it in simple terms with a car analogy (I love car analogies); if a saftey tester discovers that every single Toyota Corolla on the market (the number one selling car, 35million world wide) bursts into flames (props to fight club, note: Corollas don't afaik) if you crash at exactly 35 kilometers per hour. If he just posts this on his blog a few things will happen; everyone will know in about two seconds. The next day 35million Corolla owners will demand a refund, either destroying or severly damaging Toyota and its employees, and hooligans will wander around car parks with sledghammers hoping to hit one with the lucky 35kph speed.Basically what I am saying in a rather confused and overly long analogy is if this had been disclosed pre-vendor patch-release their would have been lost confidence in the whole internet, there would be lost jobs and money from the lost
confidence alone. Then the real fun would begin, prior to the patch being released someone would write a script to take advantage of the vulnerability, this script would then be morphed into several gui tools, and every script kiddie and his bot army would take down sites worldwide for fun and profit.
I am not saying it would have been an internet dooms-day, it could have, but the internet is pretty robust. But it would have been very damaging had the vendor patch not been released, there would have been loss of income and loss of jobs.
I agree with the way it was done, but maybe it could have been done a little sooner if you do a google search DNS cache poisoning is not new in the slightest, have a look at the wiki article. Birthday attacks are a common similar variant, I have even been involved with a cache poisoning issue a couple of times, first back in 2003. Both times I couldn't capture the culprit, there was just too many packets to wade through, but the problems were solved.
I do agree with what I have now read, maybe we need to move across to some kind of signed DNS, either SSL Dns or some kind of signed cert, like gpg and its signed keys.
We could setup the root servers all with a cert or signed key that all DNS servers are set to trust, just roll it into an update or new DNS installs then slowly cut over, then if you want to say use your ISP's servers as forwarders you could simply implictly trust the key or they could buy a signed cert (I can hear Verisign/Thawte licking there lips from here).
Supposedly due to some disclosure there maybe a script kiddie tool out soon to exploit this vulnerability, and with most NAT devices (see routers) turning patched servers into vulnerable ones and some of these routers not being patched/patchable it is only a matter of time. So everyone PATCH your servers please.
In other news, today was a snow day...yay. That won't be exciting for most northern hemisphere residents, but us here in the southern hemisphere, rarely see snow. We would have got about an inch or two, so Geoffrey and Anne saw snow for the first times in their lives; see my Flickr here, and see the video I uploaded to my Youtube here.
Peace out all, even those naysayers that say snow ain't cool.

Labels: DNS, Kids, Security, Snow