http://www.techworld.com/security/news/index.cfm?newsID=102125



By Robert McMillan

IDG News Service

10 July 2008



Computer security professionals have ganged up on Dan Kaminsky for 

violating a cardinal rule of hackerdom: publicising a flaw without 

providing the technical details to verify the finding.



Kaminsky made headlines earlier this week by talking about a major flaw 

in the DNS software used to connect computers to each other on the 

Internet. In late March he grouped together 16 companies that make DNS 

software - companies like Microsoft, Cisco and Sun Microsystems - and 

talked them into fixing the problem and jointly releasing patches for 

it.



On Wednesday this week, he took things a step further on his blog, 

asking hackers to avoid researching the problem until next month, when 

he plans to release more information about it at the Black Hat security 

conference.



He said he wanted to go public with the issue to put pressure on 

corporate IT staff and Internet service providers to update their DNS 

software, while at the same time keeping the bad guys in the dark about 

the precise nature of the problem. A full public disclosure of the 

technical details would make the Internet unsafe, he said. "Right now, 

none of this stuff needs to go public."



He quickly received a sceptical reaction from Matasano Security 

researcher Thomas Ptacek, who blogged that Kaminsky's cache poisoning 

attack is merely one of many disclosures underlining the same well-known 

problem with DNS -- that it does not do a good enough job in creating 

random numbers to create unique "session ID" strings when communicating 

with other computers on the Internet.



"The bug in DNS is that it has a 16-bit session ID," he said via an 

e-mail Wednesday. "You can't deploy a new Web app with less than 128-bit 

session IDs. We've known about that fundamental problem since the '90s."



"Here comes the onslaught of interviews and media explosion for another 

overhyped bug by Dan Kaminsky," wrote a jaded (and anonymous) poster to 

the Matasano blog.



Over at the SANS Internet Storm Center, one blogger speculated that 

Kaminsky's bug had actually been disclosed three years earlier.



The flaw appears to be a serious one that could be exploited in what's 

called a "cache poisoning attack". These attacks hack the DNS system, 

using it to redirect victims to malicious websites without their 

knowledge. They have been known about for years but can be hard to pull 

off.



But Kaminsky claims to have found a very effective way of launching such 

an attack, thanks to a vulnerability in the design of the DNS surprised" 

by some of the negative reaction, but that this kind of scepticism was 

vital to the hacker community. "I'm breaking the rules," he admitted. 

"There's not enough information in the advisory to figure out the attack 

and I'm bragging about it."



According to DNS expert Paul Vixie, one of the few people who has been 

given a detailed briefing on Kaminsky's finding, it is different from 

the issue reported three years ago by SANS. While Kaminsky's flaw is in 

the same area, "it's a different problem", said Vixie, who is president 

of the Internet Systems Consortium, the maker of the most widely used 

DNS server software on the Internet.



The issue is urgent and should be patched immediately, said David Dagon, 

a DNS researcher at Georgia Tech who was also briefed on the bug. "With 

sparse details, a few have questioned whether Dan Kaminsky had 

repackaged older work in DNS attacks," he said. "It is not feasible to 

think that the world's DNS vendors would have patched and announced in 

unison for no reason."



By day's end, Kaminsky had even turned his most vocal critic, Matasano's 

Ptacek, who issued a retraction on this blog after Kaminsky explained 

the details of his research over the telephone. "He has the goods," 

Ptacek said afterward. While the attack builds on previous DNS research, 

it makes cache poisoning attacks extremely easy to pull off. "He's 

pretty much taken it to point and click to an extent that we didn't see 

coming."



Kaminsky's remaining critics will have to wait until his 7 August Black 

Hat presentation to know for sure, however.



The security researcher said he hopes that they show up for his talk. 

"If I do not have the exploit," he said. "I deserve every single piece 

of anger and distrust."





_______________________________________________      

Attend Black Hat USA, August 2-7 in Las Vegas, 

the world's premier technical event for ICT security experts.

Featuring 40 hands-on training courses and 80 Briefings 

presentations with lots of new content and new tools.

Network with 4,000 delegates from 50 nations.  

Visit product displays by 30 top sponsors in 

a relaxed setting. http://www.blackhat.com



Received on Fri Jul 11 2008 - 02:36:27 PDT