Kaminsky and Ptacek comment on DNS flaw

Kaminsky and Ptacek comment on DNS flaw

Summary: Well, well, well, what a day for security news!I got a chance to get the scoop word of mouth from Dan Kaminsky of IOActive (pictured above [image courtesy of quinnums]) and Thomas Ptacek of Matasano (pictured below) on the DNS flaw that's been all over the net today.

SHARE:
10

Dan Kaminsky of IOActive Breaks DNSWell, well, well, what a day for security news!

I got a chance to get the scoop word of mouth from Dan Kaminsky of IOActive (pictured above [image courtesy of quinnums]) and Thomas Ptacek of Matasano (pictured below) on the DNS flaw that's been all over the net today. Talking with Kaminsky over the cell phone, he said that the current fix sufficiently addresses the issue by randomizing the source ports, while simultaneously not really giving any reverse engineers out there the ability to reverse the patch to a working exploit. This will give other vendors out their time to address this issue. Kaminsky commented that DNS is obviously a very important part of the Internet, so a spoofing flaw like what he has discovered is significant.

I asked Dan what he thought about Thomas Ptacek's Thomas Ptacek of Matasanocomments suggesting that the flaw was blown out of proportion and Dan said that the flaw is very real and very serious and that the details will be out at Black Hat. Dan mentioned to me that he was very pleased with how everything has worked with the multi-vendor disclosure process, as he said, "we got several vendors together and it actually worked". To be honest, this type of collaboration is long overdue, and there's a lot of folks in the industry asking for it, and I'm not just talking about the tech companies cooperating, several banking and financial companies have discussed forums for knowledge sharing, and of course eBay has tried to pioneer this with their "eBay Red Team" event. It's refreshing to here a well respected researcher like Dan feeling very positive about an experience with multiple vendors working together (my own experience has been a lot of finger pointing and monkey business).

Read on for Ptacek's comments...

I spoke with Ptacek over an AIM chat this evening, and he had some enlightening thoughts on the matter, stating:

"My thought is, what we really have is a new exploit for an old vulnerability nobody bothered to fix because no 'perfect' fix is available. Dan won't release any details... he says that's the terms for getting vendors to cooperate. I don't understand why that leaves him room to talk about it at Black Hat, but in the absence of details all you have to go on is what the patch is.

The vulnerability says, you can spoof responses to DNS queries and the patch is to randomize source ports, if your source ports weren't randomized already. If this is really the problem, then as of 2002 when that guy from Brazil found the outstanding query bug, it would have taken less than 10 seconds to spoof a DNS response anyways. So unless this vulnerability, I don't know, makes a ninja come out of your LCD screen and chop your head off I think it's probably not super new."

Both of us did comment though that in years of watching Dan's talks, actually seeing a Ninja come out of an LCD screen and chop someone's head off didn't see horribly far-fetched. My conversation with Ptacek continued:

Nate: Your thoughts on this seem to go back to your thread where you said "It's like I don't even care if DNS is secure", since there's so many other things to be worried about as well.

Ptacek: Exactly. I mean i don't want to take down Kaminsky for working in DNS at all, DNS security is interesting, and Dan usually has cool findings in it

Nate: This is true.

Ptacek: But I mean, come on --- Dan's DNS credibility is unimpeachable, so I think he can deal with this criticism: He probably didn't find anything that is more important than the fact that a 16 bit random number isn't secure in the age of OWASP.

Nate: What do you mean by that?

Ptacek: If the fix is "randomize your source ports", we already knew you were vulnerable. Look, DNS has a 16 bit session ID... how big is an ASPSESSIONID or JSESSIONID? When you get to this point you are way past deck chairs on the titanic, but, I mean, the web people already know this. This is why TLS/SSL totally doesn't care about the DNS. It is secure regardless of the fact that the DNS is owned.

If the IETF would just find a way to embrace TLS/X509 instead griping about how Verisign is out to get us we wouldn't have this problem. Instead, DNSSEC tried to reinvent TLS by committee... well, surprise surprise, in 2008, we still care about 16 bit session IDs! Go Internet!

Nate: Tom, thanks a lot for talking with me on the subject.

So, very interesting stuff going on here. Man if Vegas doesn't bring out the most interesting topics. Quite a day when you get to talk to two of your favorite security researchers (Kaminsky and Ptacek) on a flaw that is sure to make huge news, that is currently under wraps with lots of controversy.

I will say this, Dan is as legitimate a showman as the security research/hacking community has. I can still remember him telling me point blank that his ToorCon Seattle talk would blow me away, preparing for that, then being more blown away than I could've ever expected by his presentation (see info on his Non-existent Sub-Domain attacks from ToorCon Seattle). I've got high hopes for fireworks from Dan at Vegas, and hell, even if, for some reason, the research turns out to be less than Dan originally thought, he'll still put on an interesting talk by just being fun to watch and hilarious.

See you in Vegas, bring your drinking shoes.

-Nate

Topics: Networking, Browser, Security

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

10 comments
Log in or register to join the discussion
  • "Important"

    I guess Microsoft agrees that it's not a really scary vulnerability.
    Larry Seltzer
    • Actually

      I talked to Dan about this. It early on threw me off too, but their rating has to do with the fact that it is a spoofing flaw, and not an arbitrary code execution or something like that, but they are treating it with a sense of urgency. Important risk rating in the DNS world is very critical to Microsoft apparently.

      -Nate
      nmcfeters
  • RE: Kaminsky and Ptacek comment on DNS flaw

    First off, big props to Dan for getting this problem fixed in a responsible manner. If there were widespread real attacks first, it would take forever to get fixes out into the field.

    However, we in the security circles don't need to spread the "Kaminsky finds" meme. Take a look at <http://tools.ietf.org/wg/dnsext/draft-ietf-dnsext-forgery-resilience/>. The first draft of this openly-published document was in January 2007. It is now in WG last call.

    The take-away here is not that "Dan didn't discover the problem", but "Dan got it fixed". An alternate take-away is that IETF BCPs don't make nearly as much difference as a diligent security expert with a good name.

    --Paul Hoffman, Director
    --VPN Consortium
    fishytv
    • You don't know that

      You're generalizing on claims that can't be substantiated since you don't know what exploit he actually pulled off. I've also heard a SANS GIAC student reported the same thing back in 2005.

      Let me say this, Dan's research may have been based off of others, but I would be highly surprised if it didn't have his own ninja twist to make it really kick DNS around.

      Let's give Dan the benefit of the doubt until BH is done.

      -Nate
      nmcfeters
    • RE: Kaminsky and Ptacek comment on DNS flaw

      I like this article, harvesting is also great, Thank you for sharing.<a href="http://www.perfectreplicawatch.co.uk/watch-accessories-c-134.html">watch accessories</a>
      biasedfans
  • Grammar

    As a professional journalist, please learn the difference between "their" and "there," and "hear" and "here."
    ZDNET_guest666
  • Imperfect fix for an imperfect DNS ?

    What's funny is, this bug have been there for like 20 years (or more?) ? And no one wanted to fix it? Instead fixing, IETF should just propose a NEW DNS (like SecureDNS), for Internet post 2010, that should be a lot better, safer and secure than just a simple and imperfect "fix".

    Btw, why this "fix" is so important? Simple, a hack could turn www.yourbank.com into HIS own site. Can you see that?

    Gradius
    Gradius2
  • louis vuitton outlet

    bvxcad<p><a href="http://www.gelvlouisvuittonoutlet.org" title="louis vuitton outlet"><strong>louis vuitton outlet</strong></a> leads you to bags collection of wide, such as LV bags and LV handbag etc. They are main name in luxury and style. It is excellent quality, fine Italian technology and extraordinary beauty.<a href="http://www.gelvlouisvuittonoutlet.org" title="louis vuitton online"><strong>louis vuitton online</strong></a> as a professional LV Earrings online supplier, we have enjoyed the fullest respect for our in-time delivery, moderated price and superior quality.</p>

    <p>The choices are likely to be basically countless seeing that <a href="http://www.golvlouisvuittonbags.com" title="louis vuitton outlet"><strong>louis vuitton outlet</strong></a> occurs with the help of completely new and also incredible concepts once in a while.Carry these <a href="http://www.golvlouisvuittonbags.com" title="louis vuitton purses"><strong>louis vuitton purses</strong></a> of slouched styles with all your laidback looks this season and beyond.?It's the time to treat yourself now.</p>

    <p>any <a href="http://www.illouisvuittonoutlet.com" title="louis vuitton outlet"><strong>louis vuitton outlet</strong></a> New backpack features usa a function grownup overall look. Varied piece allows that it is captivated me within the approve and also further than your body.LV has been the symbol of fashion and nobility for quite a long time. The <a href="http://www.illouisvuittonoutlet.com" title="louis vuitton online"><strong>louis vuitton online</strong></a> shop has become so famous all around the world recently.<a href="http://www.illouisvuittonoutlet.com" title="louis vuitton outlet online"><strong>louis vuitton outlet online</strong></a> Cupertino M56398 is manufactured out of monogram Canvas,natural cowhide clippings along with elaborate tissage cells lining cause it to be quite specific.</p>

    <p>LV bags in the <a href="http://www.iulouisvuittonoutlet.net" title="louis vuitton outlet"><strong>louis vuitton outlet</strong></a> are a feminine update on an urban classic. With plenty of room for all of your essentials this covetable carryall will take you through the weekend in style.If you feel more and more online shopping department store thinned Market,then do a local version of their own. When the gradual opening of <a href="http://www.iulouisvuittonoutlet.net" title="louis vuitton outlet online"><strong>louis vuitton outlet online</strong></a>. Public will be increasingly in popularity.<a href="http://www.iulouisvuittonoutlet.net" title="louis vuitton online"><strong>louis vuitton online</strong></a> shop sounds like a melody to most people all over the world. It is apparent to us all that Louis Vuitton has enjoyed its global prevalent selling for ages.</p>

    <p>Almost no one can resist the temptation of LV Bags.There established many online <a href="http://www.llouisvuittonoutlet.org" title="louis vuitton outlet"><strong>louis vuitton outlet</strong></a> recently with the aim of making people's shopping more convenient.Is without a doubt <a href="http://www.llouisvuittonoutlet.org" title="louis vuitton online"><strong>louis vuitton online</strong></a> seriously is present? Is it possible to offer an outlet designed for Louis Vuitton merchandise speaks out?</p>

    <p>This collection focus more on color selection compared with other LV handbags. Cute and sunshine design style increases its charm. <a href="http://www.louisvuitton-outletonline.info" title="louis vuitton outlet online"><strong>louis vuitton outlet online</strong></a> provides you the very famous luxury worldwide brand.Here is a world of <a href="http://www.louisvuitton-outletonline.info" title="louis vuitton outlet"><strong>louis vuitton outlet</strong></a> where you can find all kinds of new style and fashion Louis Vuitton bags. We really want to lead the trend and let our customer in the pursuit of luxury and fashion, satisfied the needs of customers.<a href="http://www.louisvuitton-outletonline.info" title="louis vuitton online"><strong>louis vuitton online</strong></a> shop sounds like a melody to most people all over the world. It is apparent to us all that Louis Vuitton has enjoyed its global prevalent selling for ages.</p>
    factoryoutlet
  • coach outlet

    fnjhzsx<p><a href="http://www.coachfactorystoreoutlete.net" title="coach factory outlet"><strong>coach factory outlet</strong></a> offers you the modern and very comfortable coach bags. Since many women often do not know things and are daily buses to challenge their handbags handbag, also comprehensive.products of <a href="http://www.coachfactorystoreoutlete.net" title="coach factory store"><strong>coach factory store</strong></a> as well as can easily hand bags, mens totes, internet business bags, luggage, wallets, and also regularly produce unique set increased coach clutches model effect.You will easily notice the unfold zippers of this <a href="http://www.coachfactorystoreoutlete.net" title="coach factory outlet store"><strong>coach factory outlet store</strong></a>. That is the decoration. There are some inside pockets for you as well. They are easy to match your clothes and to carry.Many fashionable women match with practical Coach Purses which will make the street shopping become relaxed,and make every person can enjoy more diversiform combination in <a href="http://www.coachfactorystoreoutlete.net" title="coach factory outlet online"><strong>coach factory outlet online</strong></a>.</p>

    <p>Attention! <a href="http://www.godocoachoutlet.org" title="coach outlet"><strong>coach outlet</strong></a> is offering new products at favorable prices for August. Brighter colors, finer looks and newer designs, all bring you a whole new summer.The <a href="http://www.godocoachoutlet.org" title="coach factory outlet"><strong>coach factory outlet</strong></a> has been in business for many years. You can log in to find more information about its products and services.There are some practical and beautiful items for sale at <a href="http://www.godocoachoutlet.org" title="coach factory outlet online"><strong>coach factory outlet online</strong></a> for your selection. Do not miss it and have one for a try.</p>

    <p>If you do not know design can be the most fashionable this fall, consider a glance on <a href="http://www.coachfactoryonlines.net" title="coach factory outlet"><strong>coach factory outlet</strong></a>! This summer, you have a wide range of options, because there are numerous designs, you can find from.Attention! <a href="http://www.coachfactoryonlines.net" title="coach outlet"><strong>coach outlet</strong></a> is offering new products at favorable prices for August. Brighter colors, finer looks and newer designs, all bring you a whole new summer.<a href="http://www.coachfactoryonlines.net" title="coach factory"><strong>coach factory</strong></a> Outlet are leading the international market all the time, because men and women choose to buy these Coach Products to use for leisure, work or travel than any other designer brands.Each and every woman wants to possess a coach bag. <a href="http://www.coachfactoryonlines.net" title="coach factory outlet online"><strong>coach factory outlet online</strong></a> This brand of handbags will not price you a great deal of cash.</p>

    <p>On establishing contact with a <a href="http://www.coachhoutlet.com" title="coach outlet"><strong>coach outlet</strong></a> hire agency, a few clarifications would need to be put to rest prior to working out a deal.Modern designs and faddish shapes make Coach products enjoy high reputations around the world. <a href="http://www.coachhoutlet.com" title="coach factory outlet"><strong>coach factory outlet</strong></a> a shopping place just for you.<a href="http://www.coachhoutlet.com" title="coach factory"><strong>coach factory</strong></a> not only supply with the highest quality crystal at reasonable price but also provide good after-sales service. Companies operating purposes: science and technology in order to survive, credibility and development, strict quality control.There are some practical and beautiful items for sale at? <a href="http://www.coachhoutlet.com" title="coach factory outlet online"><strong>coach factory outlet online</strong></a> for your selection. Do not miss it and have one for a try.</p>

    <p><a href="http://www.coachhoutlet.net" title="coach outlet"><strong>coach outlet</strong></a> has become a popular shopping experience for consumers around the world, and a desirable distribution channel for manufacturer's and retailers.Coach is a leading American designer and maker of luxury lifestyle handbags and accessories.There is no doubt that here <a href="http://www.coachhoutlet.net" title="coach factory outlet"><strong>coach factory outlet</strong></a> is the exact place you should visit.There are different kinds of crossbody bags within marketplace nowadays. Even so it is not possible to beat the timeless design jointly with traditional elegance of the Bags at the <a href="http://www.coachhoutlet.net" title="coach factory outlet online"><strong>coach factory outlet online</strong></a>.After graduating from university, my cousin came back to my hometown from USA last month. She told me that <a href="http://www.coachhoutlet.net" title="coach outlet store"><strong>coach outlet store</strong></a> is very popular among her classmate.</p>

    <p><a href="http://www.coachoutletonlinee.net" title="coach outlet online"><strong>coach outlet online</strong></a> is your smart choice when you want to get the discount Coach accessory. You can find the exact Coach Bags and other accessory you want at a low price that's right for you. My dear friends, let the <a href="http://www.coachoutletonlinee.net" title="coach outlet online"><strong>coach outlet online</strong></a> pave your way into the world of high fashion with their ultimate fashion factory.<a href="http://www.coachoutletonlinee.net" title="coach outlet"><strong>coach outlet</strong></a> handbags You can not just save your cash but also your time inside a convenient way to obtain the exact same bags product and do not be concerned the shippment of one's products.If you desire to go to <a href="http://www.coachoutletonlinee.net" title="coach factory outlet"><strong>coach factory outlet</strong></a>, but have no idea in which to go, you can research online. It is no doubt that there is drastically information and details about it for the reference.Tens of millions of girls all more than the world feel that Coach Classic C Tote Bag Beige really are a needed accessory. <a href="http://www.coachoutletonlinee.net" title="coach factory"><strong>coach factory</strong></a> outlet provides you the most common designer handbag with many discounts.</p>

    <p><a href="http://www.coachfactorysoutlets.com" title="coach factory outlet"><strong>coach factory outlet</strong></a> has a big heart and a healthy appetite, and a wicked swing with a chainsaw. After a knee injury ended his career as a defensive lineman in college, Coach salvaged his Physical Education degree(barely)and landed a job teaching health at the local high school in his hometown of Savannah.<a href="http://www.coachfactorysoutlets.com" title="coach outlet"><strong>coach outlet</strong></a> handbags's special design and fashion is certainly and so eye-catching, I hope you are able to get much more attention towards the Cheap Coach Crossbody.Are you searching for a cool and stylish coach bag? The <a href="http://www.coachfactorysoutlets.com" title="coach factory outlet online"><strong>coach factory outlet online</strong></a> Online is your first priority.Here's your new way to look sophisticated styles. Carry the hot <a href="http://www.coachfactorysoutlets.com" title="coach factory outlet store"><strong>coach factory outlet store</strong></a> of this summer and be the true trendsetter!</p>

    <p>customers are not only interested in handbags and purses, but also fond of?shoes and jewelry which is sold at the <a href="http://www.coachoutletsstoree.com" title="coach outlet"><strong>coach outlet</strong></a>.Mainly because products are rattling straight forward, locomotion, to see our own elements connected with <a href="http://www.coachoutletsstoree.com" title="coach factory outlet"><strong>coach factory outlet</strong></a> you can actually just make an effort to accomplish without this.There are some practical and beautiful items for sale at? <a href="http://www.coachoutletsstoree.com" title="coach factory outlet online"><strong>coach factory outlet online</strong></a> for your selection. Do not miss it and have one for a try.</p>
    factoryoutlet
  • full lace wigs application

    Thank goodness we can now shop easily, quickly, and in complete anonymity on the computer. You can perform an online search and in seconds you can be looking at a great selection of <b>cheap full lace wigs</b> with full descriptions. There are literally hundreds to choose from, in every color, texture, length and style. You can choose from <b><a href="http://www.fulllacewigsforsale.com/2011/08/26/what-makes-full-lace-wigs-irresistible/">cheap full lace wigs human hair</a></b>. There are many different kinds of caps and construction methods to choose from, and the range in prices is great. You can buy cheap wigs or very expensive ones. Once you are at the site you can select a <b><a href="http://www.fulllacewigsforsale.com/2011/08/26/how-to-remove-full-lace-wigs/">full lace wigs</a></b> and have it shipped to you overnight. No one will be aware, and you can sport the new look the next day at work or when you head out for a night on the town with friends.
    arionbu