What do I need to know about the DNS vulnerability?

Home » Internet

Summary: A vulnerability has been discovered in the DNS servers providing a critical part of internet infrastructure. It's easy to test and easy to work around.

DNS is one of those critical internet infrastructure things that we just don't think of all that often. But it is, indeed, critical. And when a vulnerability is discovered, it's a big deal.

A very big deal.

•

In short, DNS is the service that your computer uses to turn names you and I can read and recognize, like "ask-leo.com", into IP addresses like 72.3.133.152 that are used by the internet to actually transfer data.

It's good that you don't care about the exact details, because at this writing they haven't actually been divulged yet, and the various theories are fairly complex.

The effect of the vulnerability is that if it is successfully exploited, a DNS request for a specific name can be forced to return the wrong IP address. So imagine that you're going to paypal.com and the DNS request that asks "what's the IP address for paypal.com?" returns an IP address of a hacker's server instead. A hacker's server that is crafted to look like Paypal, but is most definitely not Paypal. How would you know?

That's why it's a big deal. Even after a very large push to get all the DNS servers patched before the vulnerability became public, the fact is that even today that vulnerability still exists on too many DNS servers.

So, what can you do?

The good news is that this is easy to detect, and easy to work around, even though it's not your problem.

That's correct, it's not your problem. This is not something that's present on your computer. (Unless, that is, you're a geek running your own DNS server, like I am.) DNS servers are provided by your ISP, and it's there that the vulnerability may lie.

Test your DNS. Visit this link:

http://149.20.3.33/test/

You'll note that's an IP address - if it were a normal name it would require a DNS look up using the very DNS server that you don't yet trust. (Thanks Michael Horowitz for that tidbit. And yes, in theory it could still be spoofed; more on that below.)

You will be presented with two charts. The key is that you want both "Randomness" results to be "Great", and that each time you run the test the graphed dots and the list of "Values Seen" are different. That's all. If you get "Great" for both tests, you're done. (If you travel, or use a hotspot, you'll need to run this test at each location before you can feel safe.)

If you didn't get "Great" for both, there are two things I believe you must do:

• Complain to your ISP. They are vulnerable, meaning all of their customers are vulnerable. Patches and updates are readily available, so there's simply no excuse not be up to date.

• Switch to OpenDNS. OpenDNS is a free DNS alternative that is known not to be vulnerable. Whether you stick with it long term is up to you, but as a short term way to avoid your ISP's vulnerable DNS servers, it's a perfect and quick solution. Instructions are here.

Now, I mentioned above that the test could be spoofed. Even when you go to the main page of the test by IP address rather than by name, the test itself still has to use DNS to perform the test. The danger scenario looks like this: your ISP has a vulnerable DNS server, that has been exploited. As part of the exploit the DNS names for the test servers are redirected to IP addresses of servers that always return "Great", no matter what. I honestly don't think this is very likely, but I include it for completeness.

If there's any question at all, you'll be safe switching to OpenDNS.

You'll likely hear more about this vulnerability in the coming weeks, but as long as things are "Great" you'll know you're safe.

Related:

• How does flushing DNS help resolve some issues, and while you're at it what's DNS? DNS transforms domain names into IP addresses. Your PC caches or remembers much of the DNS information but sometimes, though, it needs to forget.

• My ISP's DNS servers are timing out frequently, what can I do? Slow Domain Name System (DNS) lookups can affect your apparent internet speed. Your ISP should provide fast DNS, but there are also alternatives.

• Doxpara Research The blog of the vulnerability discoverer and the canonical place for details once they're available.

• Bailiwicked Domain Attack Security Now! episode detailing DNS and the vulnerability.

Article 12593 | Posted August 2, 2008