Kaminsky's exploit exposes Internet

Thinking beyond the patch

John Markoff's New York Times recent story on the DNS exploit will no doubt draw significant attention to what Cricket Liu called one of the most significant vulnerabilities of all time. A few days after the easy to launch exploit was published on the Internet,  evidence of attacks were soon reported, even against security experts including HD Moore, who was apparently also victimized by vulnerable AT&T servers.

This problem is particularly troubling because this flaw is widely known and present in an estimated 11 million servers responsible for directing traffic throughout the Internet.  Dan Kaminsky, a Web security specialist, showed how the flaw could be exploited in seconds, in effect revolutionizing the economics of identity theft.

While service providers have been patching the vulnerability with limited success, leaving millions of core servers exposed, the story gets worse.  Recent news suggests that firewalls may have been impacted, including those widely deployed to protect servers.  Compatibility issues between the DNS vulnerability patch and firewalls have been reported to create additional availability risks, which mean that patching could proceed even more slowly than before.  Fixes are on the way. 

This is clearly a fluid, dynamic situation and possibly a sign of the times as the Internet comes of age.

While news of vulnerabilities, exploits and the sheer magnitude of this problem spreads, perhaps there is a silver lining.  Perhaps CIOs will start dealing with the core challenge inadvertently laid bare by Kaminsky: that the Internet has outgrown its caretakers.

A Historical Perspective

In the early 1990s the Internet quickly encircled the globe, and was soon transporting incomprehensible levels of traffic to mushrooming populations of endpoints.  All the while we heard about how resilient the Internet was, because it was architected to survive a nuclear blast.  After all, the nuclear blast was and still is the classic metaphor for total destruction.  Yet no one ever considered the destructive power of an attack on the core of the Internet: integrity.

From an economic standpoint, the Kaminsky DNS exploit may be the Internet's equivalent of a nuclear strike; yet it doesn't require a PhD with years of training, specialized uranium enrichment equipment or even a sophisticated form of delivery.  It can be launched in seconds by any one of tens of thousands of hackers from almost anywhere in the world. 

A successful DNS exploit wouldn't destroy the physical Internet per se, but would rather neutralize its core integrity, its ability to act as an ecommerce enabler.  Security and availability are, after all, the Internet's bricks and mortar.

The Core Challenge

As the Internet exploded onto the scene it became responsible for transporting more traffic to more locations between more applications.  Managing the domain names and addresses for a mushrooming population of endpoints created a market for more than 11 million DNS servers solely responsible for directing that traffic.

Not only are many of those servers past their prime, the methods for managing them have simply not kept up with their increasingly strategic importance.  Hence patching the DNS vulnerability won't be accomplished in a timely manner for many critical servers, even though the patch is the only protection and it still isn't a permanent fix.

The core challenge to the success of the Internet going forward from the "Kaminsky event" isn't really about applying a single patch, although the DNS vulnerability is probably the most significant security threat to the Internet since its inception.  The core challenge will be related to how easily this large population of core servers can be managed, secured, updated and tracked.

In essence, the meteor has landed again in the world of technology, and flexibility and control will come to the forefront as a requirement for IT survival.

If an unprecedented vulnerability only gets patched on 1/3 of name servers after 30 days of industry headlines and relentless warnings from security experts; just how well managed will be other critical aspects of Internet integrity?  Is anyone naïve enough to think that this will be the last threatening exploit against a list of known vulnerabilities or even zero day attacks (against undiscovered vulnerabilities)? 

Kaminsky has indirectly proven that the caretakers of the Internet are today wholly incapable of protecting it.  And the widely deployed tools and technologies once depended on are no longer sufficient for keeping up with the mushrooming role, complexity and demands of ensuring the integrity of the Internet.

The Rise of Core Network Services

This recent cache poisoning exploit event is likely to be one of many, and even the patch isn't a permanent fix.  The only long term solution, therefore, will require the automation of core network services and the proliferation of grid computing capabilities throughout public and private networks populated with DNS servers.  

Core network services must move from being a scattered, freeware and spreadsheet dominated role to an advanced, strategic function supported by a new generation of dedicated appliances that automate critical functions and ensure proper reporting, accuracy and delegation of duties in seconds instead of days or weeks.

Kaminsky may have exposed a critical vulnerability in the Internet; he may also have become a catalyst for a more secure, more available and more robust Internet.  While the New York Times featured the DNS challenge and Kaminsky, it has made it obvious that the solution is far bigger than any single patch or personality.  It has heralded a new age in core network services.

You can access technical DNS resources at Cricket Liu's DNS Resources Page or at DNSstuff.

 

 

You can read my disclaimer at: About « ARCHIMEDIUS.