http://www.theregister.co.uk/2008/07/25/isps_slow_to_patch/



By Dan Goodin in San Francisco

The Register

25th July 2008



More than two weeks after security researchers warned of a critical 

defect in the net's address lookup system, some of the world's biggest 

internet service providers - including AT&T, BT, Time Warner and Bell 

Canada - have yet to install a patch inoculating their subscribers 

against attacks.



According to an informal survey of Register readers, 15 ISPs failed the 

"Check my DNS" [1] test (see button to the right) on the website of 

researcher Dan Kaminsky, who discovered the bug. Now that attack code 

exploiting the vulnerability has been leaked into the wild [2], millions 

of subscribers are at risk of being silently redirected to impostor 

sites that try to install malware or steal sensitive information. 

Comcast and Plusnet were the only two ISPs we found that weren't 

vulnerable.



The lack of action comes after Kaminsky, domain name resolution guru 

Paul Vixie and others have repeatedly warned that the vulnerability has 

the potential to wreak havoc on the net. Their advisories became more 

urgent following the leaking of the vulnerability details, which 

Kaminsky intended to keep private until next month's Black Hat 

conference in Las Vegas.



[1] http://www.doxpara.com/

[2] http://www.theregister.co.uk/2008/07/24/dns_exploit_goes_wild/



[...]





_______________________________________________      

Attend Black Hat USA, August 2-7 in Las Vegas, 

the world's premier technical event for ICT security experts.

Featuring 40 hands-on training courses and 80 Briefings 

presentations with lots of new content and new tools.

Network with 4,000 delegates from 50 nations.  

Visit product displays by 30 top sponsors in 

a relaxed setting. http://www.blackhat.com



Received on Fri Jul 25 2008 - 05:36:57 PDT