Comcast launches first public U.S. trial of advanced DNS security

New security mechanism aims to protect web operators and consumers from specific hijacking hack attacks

Comcast unveiled on Tuesday an aggressive plan to deploy new DNS security mechanisms that are designed to protect Web site operators and consumers from a specific type of hacking attack that involves hijacking Web traffic and redirecting it to bogus sites.

In a blog post, Comcast said it has deployed DNS Security Extensions -- dubbed DNSSEC -- throughout its nationwide network and will immediately make validating servers available to any of its customers that want to experiment with this emerging security technique.

In addition to this public trial of DNSSEC validation services, Comcast says it will digitally sign all of its own domain names -- more than 5,000 in total -- using DNSSEC by the first quarter of 2011.

By the end of 2011, Comcast says it will have production-quality DNSSEC resolution services available to all of its business and residential customers.

"There is often talk about a chicken-and-egg sort of problem with DNSSEC. People don't want to sign their own domains with DNSSEC until people are validating signatures," says Jason Livingood, Executive Director of Internet Systems Engineering at Comcast. "We want to explain how we as an ISP have a road map for validating signatures with DNSSEC."

DNSSEC is an Internet standard that prevents spoofing attacks by allowing Web sites to authenticate their domain names and corresponding IP addresses using digital signatures and public-key encryption. When DNSSEC is fully deployed, Internet users will be able to verify that the Web sites they visit are digitally signed.

Comcast is believed to be the first U.S. carrier to announce plans to support resolution of DNSSEC queries for its customers as well as to sign its own domain names using DNSSEC.

"There are no large U.S. ISPs that have been publicly resolving and signing using DNSSEC in a large trial. But there are lots of people doing small little tests of DNSSEC," says Paul Hoffman, Director of the VPN Consortium and an active participant in DNSSEC standards development work by the Internet Engineering Task Force.

Hoffman says until now no U.S. carrier has committed to DNSSEC resolution, which could be a stumbling block to DNSSEC deployment.

"Many people have been worried that there would be a lot of people signing their domain names, and no one checking for the resolution," Hoffman says. "A major ISP doing both halves of the equation with DNSSEC is a big deal."

DNSSEC is a hierarchical system, and it requires authentication at every step in the process of matching a domain name with the corresponding IP address. In order for a user to receive an authenticated response from a popular Web site such as www.amazon.com, DNSSEC needs to be deployed on the Internet's root servers, the .com domain servers operated by VeriSign, and the DNS servers operated by Amazon or its Web-hosting company. Consumers who visit Amazon's Web site also need their ISPs to validate the digital signature they receive.

DNSSEC is in the process of being deployed across the Internet's infrastructure. The DNS root servers will be signed in July, and VeriSign has committed to supporting DNSSEC on the .com and .net servers by early 2011. The U.S. federal government is deploying DNSSEC across the .gov domain, and the Public Interest Registry is supporting DNSSEC in .org.

Once the DNS root servers as well as popular top-level domains such as .com and .net are signed, DNSSEC is expected to be widely adopted by Web site operators such as Amazon.

Until now, U.S. ISPs have been slow to commit to DNSSEC. That's why Comcast's DNSSEC announcement is significant.

"The intention of the trial is to see what things [happen] operationally with DNSSEC and to get ready to do this for the entire customer base once the root is signed and once the major top-level domains are signed," Livingood says.

Comcast said its public trial of DNSSEC includes immediate availability of DNSSEC validating servers using an Internet addressing and routing scheme known as Anycast.

Comcast has 12 sites across its network that process and cache DNS queries, and all 12 of these locations will handle DNSSEC resolution during the public trial.

"Our subscribers should be able to expect the same level of service for our DNSSEC servers as with our regular DNS servers," Livingood says. He added that "the critical difference with this trial is that DNSSEC will be on the servers that are very close to the customers just as the nomral DNS servers are so they won't see a performance hit when they are using these on a trial basis."

Until the DNS root servers are signed, Comcast will use what's called a trust anchor repository to validate DNSSEC queries at the top of the DNS tree. Comcast is using IANA's trust anchor repository for its public DNSSEC trial.

Comcast is promising an easy transition to production-level DNSSEC resolution services for its customers.

"When we turn on DNSSEC for all of our customers nationally in 2011, it will happen automatically," Livingood says. "We will have tested it, and it will be seamless. People will not have to change their IP addresses. It will all occur behind the scenes."

Comcast also revealed its roadmap for signing its own domain names by March 2011. Comcast already has end-to-end DNSSEC validation on several domains including www.comcast.org, www.mycomcast.org and www.comcastbusiness.org .

"We have 5,000 top-level domains that we manage like Comcast.net that we're talking about signing," says Chris Griffiths, manager for high-speed Internet engineering at Comcast.

Comcast is using Nominum's authoritative DNS software for its DNSSEC trial and deployment.

"Comcast is one of Nominum's largest DNS customers and has long been a model for the industry on how to do DNS right," Nominum said in a statement. "Their plan to deploy our DNSSEC solution to combat cache poisoning and help mitigate other online threats is a significant milestone in the evolution of DNS technology and will help make the Internet a safer place for everyone."

Comcast said that the cost of deploying DNSSEC for both resolving queries and signing its domains is minimal.

"It's not a huge investment," Livingood says. "We upgraded the hardware on the servers in the past six months to be able to handle the computational load for signing this number of domains. But it hasn't required a substantial investment, although we have been working closely with our vendors to make sure the tools were easy to use and that it was not an onerous process."

Comcast has been experimenting with DNSSEC since 2008, when a high-profile flaw in the DNS -- commonly known as the Kaminsky Bug -- was revealed. DNSSEC is the only long-term fix for preventing Kaminsky-style attacks.

"Back then, we started working on all the operational issues of how difficult it is to sign zones, how difficult it is to do key roll-over and what are the challenges related to validating domains," Livingood says. "We sent a lot of feedback to the vendors we use…We think we're at the stage where a lot of this stuffy is ready to use."

Comcast is hoping that its public trial of DNSSEC resolution services and its commitment to signing its own domains will prompt other carriers to follow suit.

"What we're really trying to do is announce our own plans so that we can be a catalyst for others to take action and get serious about DNSSEC," Livingood says. "We're trying to move the Internet community ahead on DNSSEC."

Tags DNS securityhijackingcomcast

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Carolyn Duffy Marsan

Network World

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?