Kaminsky flaw prompts DNS server overhaul

The server now logs where attacks originate

One of the companies most at risk from the notorious DNS cache poisoning vulnerability has overhauled security in the latest release of its DNS server software in what looks like a major code rethink.

Nominum, which supplies a decent chunk of the global market for such servers, said it has just finished rolling out a major security upgrade to its server platform, Vantio caching DNS server, and introduced a range of new security "layers" beyond the basic Source Port Randomization (UDP SPR) fix suggested at the time the flaw was announced in early July by IOActive researcher, Dan Kaminsky.

The latest release of Vantio now features a swathe of security features that weren't there before, including the ability to block poisoning attacks against valuable domains, enhanced query response spoofing defenses which switches DNS resolution to a secure back-channel if attacked, and a new Query Response Screening system to weed out DNS poisoning attempts using fake requests.

The server also now logs where attacks originate - in contrast to the Internet generally, it is very hard to hide from DNS servers - and alerts an ISP or network if attacks have been detected.

Importantly, Nominum has also come up with a fix for the potentially major issue of using Network Address Translation (NAT) in front of an otherwise patched DNS server. Firewall and load balancing NAT assigns UDP ports sequentially, which would have rendered the port randomization defense useless.

Given that the official defense against the cache poisoning flaw has been UDP source port randomization, the Nominum overhaul comes in the nick of time. This was always seen as insufficient to keep out hackers indefinitely although it had been implemented as an interim step.

The pessimism over SPR turned out to be accurate, with Russian researcher Evgeniy Polyakov managing a proof-of-concept cache pollution hack in 10-hours using equipment that bombarded a full-patched BIND DNS server with fake DNS requests.

Just as the Kaminsky flaw has turned out to be no ordinary security scare, Nominum is no run-of-the-mill seller of Internet software. Chaired since 2001 by noted DNS luminary Paul Mockapetris, the company is responsible for resolving the domain requests of an estimated 120 million Internet subscribers to the real IP numbers that underlie them.

Along with a number of other large software outfits, Nominum was also key player in efforts by the industry and Kaminsky to resolve the flaw during the months it was kept under wraps. The vulnerability was eventually made public by Kaminsky in July with a follow-up presentation by him at Black Hat in early August in which he gave the company a prominent name check.

Despite being a relatively obscure part of the Internet's inner workings, DNS server issues have in fact arrived in a steady stream in recent years. These have been restricted in the main to problems in products from individual vendors, however. Finding a serious flaw that affects the whole Internet DNS system will go down as Kaminsky's achievement.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

John E. Dunn

Techworld
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?