Comcast launches first public U.S. trial of advanced DNS security

New security mechanism aims to protect web operators and consumers from specific hijacking hack attacks

Comcast unveiled on Tuesday an aggressive plan to deploy new DNS security mechanisms that are designed to protect Web site operators and consumers from a specific type of hacking attack that involves hijacking Web traffic and redirecting it to bogus sites.

In a blog post, Comcast said it has deployed DNS Security Extensions -- dubbed DNSSEC -- throughout its nationwide network and will immediately make validating servers available to any of its customers that want to experiment with this emerging security technique.

In addition to this public trial of DNSSEC validation services, Comcast says it will digitally sign all of its own domain names -- more than 5,000 in total -- using DNSSEC by the first quarter of 2011.

By the end of 2011, Comcast says it will have production-quality DNSSEC resolution services available to all of its business and residential customers.

"There is often talk about a chicken-and-egg sort of problem with DNSSEC. People don't want to sign their own domains with DNSSEC until people are validating signatures," says Jason Livingood, Executive Director of Internet Systems Engineering at Comcast. "We want to explain how we as an ISP have a road map for validating signatures with DNSSEC."

DNSSEC is an Internet standard that prevents spoofing attacks by allowing Web sites to authenticate their domain names and corresponding IP addresses using digital signatures and public-key encryption. When DNSSEC is fully deployed, Internet users will be able to verify that the Web sites they visit are digitally signed.

Comcast is believed to be the first U.S. carrier to announce plans to support resolution of DNSSEC queries for its customers as well as to sign its own domain names using DNSSEC.

"There are no large U.S. ISPs that have been publicly resolving and signing using DNSSEC in a large trial. But there are lots of people doing small little tests of DNSSEC," says Paul Hoffman, Director of the VPN Consortium and an active participant in DNSSEC standards development work by the Internet Engineering Task Force.

Hoffman says until now no U.S. carrier has committed to DNSSEC resolution, which could be a stumbling block to DNSSEC deployment.

"Many people have been worried that there would be a lot of people signing their domain names, and no one checking for the resolution," Hoffman says. "A major ISP doing both halves of the equation with DNSSEC is a big deal."

DNSSEC is a hierarchical system, and it requires authentication at every step in the process of matching a domain name with the corresponding IP address. In order for a user to receive an authenticated response from a popular Web site such as www.amazon.com, DNSSEC needs to be deployed on the Internet's root servers, the .com domain servers operated by VeriSign, and the DNS servers operated by Amazon or its Web-hosting company. Consumers who visit Amazon's Web site also need their ISPs to validate the digital signature they receive.

DNSSEC is in the process of being deployed across the Internet's infrastructure. The DNS root servers will be signed in July, and VeriSign has committed to supporting DNSSEC on the .com and .net servers by early 2011. The U.S. federal government is deploying DNSSEC across the .gov domain, and the Public Interest Registry is supporting DNSSEC in .org.

Once the DNS root servers as well as popular top-level domains such as .com and .net are signed, DNSSEC is expected to be widely adopted by Web site operators such as Amazon.

Until now, U.S. ISPs have been slow to commit to DNSSEC. That's why Comcast's DNSSEC announcement is significant.

"The intention of the trial is to see what things [happen] operationally with DNSSEC and to get ready to do this for the entire customer base once the root is signed and once the major top-level domains are signed," Livingood says.

Comcast said its public trial of DNSSEC includes immediate availability of DNSSEC validating servers using an Internet addressing and routing scheme known as Anycast.

Comcast has 12 sites across its network that process and cache DNS queries, and all 12 of these locations will handle DNSSEC resolution during the public trial.

"Our subscribers should be able to expect the same level of service for our DNSSEC servers as with our regular DNS servers," Livingood says. He added that "the critical difference with this trial is that DNSSEC will be on the servers that are very close to the customers just as the nomral DNS servers are so they won't see a performance hit when they are using these on a trial basis."

Until the DNS root servers are signed, Comcast will use what's called a trust anchor repository to validate DNSSEC queries at the top of the DNS tree. Comcast is using IANA's trust anchor repository for its public DNSSEC trial.

Comcast is promising an easy transition to production-level DNSSEC resolution services for its customers.

"When we turn on DNSSEC for all of our customers nationally in 2011, it will happen automatically," Livingood says. "We will have tested it, and it will be seamless. People will not have to change their IP addresses. It will all occur behind the scenes."

Comcast also revealed its roadmap for signing its own domain names by March 2011. Comcast already has end-to-end DNSSEC validation on several domains including www.comcast.org, www.mycomcast.org and www.comcastbusiness.org .

"We have 5,000 top-level domains that we manage like Comcast.net that we're talking about signing," says Chris Griffiths, manager for high-speed Internet engineering at Comcast.

Comcast is using Nominum's authoritative DNS software for its DNSSEC trial and deployment.

"Comcast is one of Nominum's largest DNS customers and has long been a model for the industry on how to do DNS right," Nominum said in a statement. "Their plan to deploy our DNSSEC solution to combat cache poisoning and help mitigate other online threats is a significant milestone in the evolution of DNS technology and will help make the Internet a safer place for everyone."

Comcast said that the cost of deploying DNSSEC for both resolving queries and signing its domains is minimal.

"It's not a huge investment," Livingood says. "We upgraded the hardware on the servers in the past six months to be able to handle the computational load for signing this number of domains. But it hasn't required a substantial investment, although we have been working closely with our vendors to make sure the tools were easy to use and that it was not an onerous process."

Comcast has been experimenting with DNSSEC since 2008, when a high-profile flaw in the DNS -- commonly known as the Kaminsky Bug -- was revealed. DNSSEC is the only long-term fix for preventing Kaminsky-style attacks.

"Back then, we started working on all the operational issues of how difficult it is to sign zones, how difficult it is to do key roll-over and what are the challenges related to validating domains," Livingood says. "We sent a lot of feedback to the vendors we use…We think we're at the stage where a lot of this stuffy is ready to use."

Comcast is hoping that its public trial of DNSSEC resolution services and its commitment to signing its own domains will prompt other carriers to follow suit.

"What we're really trying to do is announce our own plans so that we can be a catalyst for others to take action and get serious about DNSSEC," Livingood says. "We're trying to move the Internet community ahead on DNSSEC."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags DNS securityhijackingcomcast

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Carolyn Duffy Marsan

Network World
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?